According to the versions of the wavpack package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - WavPack 5.1.0 and earlier is affected by: CWE-457: Use     of Uninitialized Variable. The impact is: Unexpected     control flow, crashes, and segfaults. The component is:
    ParseCaffHeaderConfig (caff.c:486). The attack vector     is: Maliciously crafted .wav file.(CVE-2019-1010317)

  - WavPack 5.1.0 and earlier is affected by: CWE-457: Use     of Uninitialized Variable. The impact is: Unexpected     control flow, crashes, and segfaults. The component is:
    ParseWave64HeaderConfig (wave64.c:211). The attack     vector is: Maliciously crafted .wav     file.(CVE-2019-1010319)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The fix for CVE-2019-0199 was incomplete and did not     address HTTP/2 connection window exhaustion on write in     Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to     8.5.40 . By not sending WINDOW_UPDATE messages for the     connection window (stream 0) clients were able to cause     server-side threads to block eventually leading to     thread exhaustion and a DoS.(CVE-2019-10072)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in Squid 3.3.9 through 3.5.28     and 4.x through 4.7. When Squid is configured to use     Digest authentication, it parses the header     Proxy-Authorization. It searches for certain tokens     such as domain, uri, and qop. Squid checks if this     token's value starts with a quote and ends with one. If     so, it performs a memcpy of its length minus 2. Squid     never checks whether the value is just a single quote     (which would satisfy its requirements), leading to a     memcpy of its length minus 1.(CVE-2019-12525)

  - The cachemgr.cgi web module of Squid through 4.7 has     XSS via the user_name or auth     parameter.(CVE-2019-13345)

  - An issue was discovered in Squid 4.0.23 through 4.7.
    When checking Basic Authentication with     HttpHeader::getAuth, Squid uses a global buffer to     store the decoded data. Squid does not check that the     decoded length isn't greater than the buffer, leading     to a heap-based buffer overflow with user controlled     data.(CVE-2019-12527)

  - An issue was discovered in Squid 2.x through     2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7.
    When Squid is configured to use Basic Authentication,     the Proxy-Authorization header is parsed via uudecode.
    uudecode determines how many bytes will be decoded by     iterating over the input and checking its table. The     length is then used to start decoding the string. There     are no checks to ensure that the length it calculates     isn't greater than the input buffer. This leads to     adjacent memory being decoded as well. An attacker     would not be able to retrieve the decoded data unless     the Squid maintainer had configured the display of     usernames on error pages.(CVE-2019-12529)

  - Due to incorrect string termination, Squid cachemgr.cgi     4.0 through 4.7 may access unallocated memory. On     systems with memory access protections, this can cause     the CGI process to terminate unexpectedly, resulting in     a denial of service for all clients using     it.(CVE-2019-12854)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the squashfs-tools package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Integer overflow in the read_fragment_table_4 function     in unsquash-4.c in Squashfs and sasquatch allows remote     attackers to cause a denial of service (application     crash) via a crafted input, which triggers a     stack-based buffer overflow.(CVE-2015-4645)

  - (1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c,     and (4) unsquash-4.c in Squashfs and sasquatch allow     remote attackers to cause a denial of service     (application crash) via a crafted input.(CVE-2015-4646)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - urllib in Python 2.x through 2.7.16 supports the     local_file: scheme, which makes it easier for remote     attackers to bypass protection mechanisms that     blacklist file: URIs, as demonstrated by triggering a     urllib.urlopen('local_file:///etc/passwd')     call.(CVE-2019-9948)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the postgresql packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was discovered in postgresql where arbitrary SQL     statements can be executed given a suitable SECURITY     DEFINER function. An attacker, with EXECUTE permission     on the function, can execute arbitrary SQL as the owner     of the function.(CVE-2019-10208)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - When PHP EXIF extension is parsing EXIF information     from an image, e.g. via exif_read_data() function, in     PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and     7.3.x below 7.3.8 it is possible to supply it with data     what will cause it to read past the allocated buffer.
    This may lead to information disclosure or     crash.(CVE-2019-11042)

  - When PHP EXIF extension is parsing EXIF information     from an image, e.g. via exif_read_data() function, in     PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and     7.3.x below 7.3.8 it is possible to supply it with data     what will cause it to read past the allocated buffer.
    This may lead to information disclosure or     crash.(CVE-2019-11041)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the pango packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Gnome Pango 1.42 and later is affected by: Buffer     Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is:
    function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack     vector is: Bug can be used when application pass     invalid utf-8 strings to functions like     pango_itemize.(CVE-2019-1010238)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the openldap packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An issue was discovered in the server in OpenLDAP     before 2.4.48. When the server administrator delegates     rootDN (database admin) privileges for certain     databases but wants to maintain isolation (e.g., for     multi-tenant deployments), slapd does not properly stop     a rootDN from requesting authorization as an identity     from another database during a SASL bind or with a     proxyAuthz (RFC 4370) control. (It is not a common     configuration to deploy a system where the server     administrator and a DB administrator enjoy different     levels of trust.)(CVE-2019-13057)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the oniguruma package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A use-after-free in onig_new_deluxe() in regext.c in     Oniguruma 6.9.2 allows attackers to potentially cause     information disclosure, denial of service, or possibly     code execution by providing a crafted regular     expression. The attacker provides a pair of a regex     pattern and a string, with a multi-byte encoding that     gets handled by onig_new_deluxe(). Oniguruma issues     often affect Ruby, as well as common optional libraries     for PHP and Rust.(CVE-2019-13224)

  - A NULL Pointer Dereference in match_at() in regexec.c     in Oniguruma 6.9.2 allows attackers to potentially     cause denial of service by providing a crafted regular     expression. Oniguruma issues often affect Ruby, as well     as common optional libraries for PHP and     Rust.(CVE-2019-13225)

  - An issue was discovered in Oniguruma 6.2.0, as used in     Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP     through 7.1.5. A heap out-of-bounds write occurs in     bitset_set_range() during regular expression     compilation due to an uninitialized variable from an     incorrect state transition. An incorrect state     transition in parse_char_class() could create an     execution path that leaves a critical local variable     uninitialized until it's used as an index, resulting in     an out-of-bounds write memory     corruption.(CVE-2017-9228)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the nmap packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - nse_libssh2.cc in Nmap 7.70 is subject to a denial of     service condition due to a double free when an SSH     connection fails, as demonstrated by a leading \n     character to ssh-brute.nse or     ssh-auth-methods.nse.(CVE-2017-18594)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the nginx packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - nginx before versions 1.15.6 and 1.14.1 has a     vulnerability in the implementation of HTTP/2 that can     allow for excessive memory consumption. This issue     affects nginx compiled with the ngx_http_v2_module (not     compiled by default) if the 'http2' option of the     'listen' directive is used in a configuration     file.(CVE-2018-16843)

  - nginx before versions 1.15.6 and 1.14.1 has a     vulnerability in the implementation of HTTP/2 that can     allow for excessive CPU usage. This issue affects nginx     compiled with the ngx_http_v2_module (not compiled by     default) if the 'http2' option of the 'listen'     directive is used in a configuration     file.(CVE-2018-16844)

  - Some HTTP/2 implementations are vulnerable to resource     loops, potentially leading to a denial of service. The     attacker creates multiple request streams and     continually shuffles the priority of the streams in a     way that causes substantial churn to the priority tree.
    This can consume excess CPU.(CVE-2019-9513)

  - Some HTTP/2 implementations are vulnerable to window     size manipulation and stream prioritization     manipulation, potentially leading to a denial of     service. The attacker requests a large amount of data     from a specified resource over multiple streams. They     manipulate window size and stream priority to force the     server to queue the data in 1-byte chunks. Depending on     how efficiently this data is queued, this can consume     excess CPU, memory, or both.(CVE-2019-9511)

  - Some HTTP/2 implementations are vulnerable to a header     leak, potentially leading to a denial of service. The     attacker sends a stream of headers with a 0-length     header name and 0-length header value, optionally     Huffman encoded into 1-byte or greater headers. Some     implementations allocate memory for these headers and     keep the allocation alive until the session dies. This     can consume excess memory.(CVE-2019-9516)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Some HTTP/2 implementations are vulnerable to window     size manipulation and stream prioritization     manipulation, potentially leading to a denial of     service. The attacker requests a large amount of data     from a specified resource over multiple streams. They     manipulate window size and stream priority to force the     server to queue the data in 1-byte chunks. Depending on     how efficiently this data is queued, this can consume     excess CPU, memory, or both.(CVE-2019-9511)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libreoffice packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - libreoffice: Arbitrary python functions in arbitrary     modules on the filesystem can be executed without     warning (CVE-2018-16858)

  - LibreOffice has a feature where documents can specify     that pre-installed scripts can be executed on various     document events such as mouse-over, etc. LibreOffice is     typically also bundled with LibreLogo, a programmable     turtle vector graphics script, which can be manipulated     into executing arbitrary python commands. By using the     document event feature to trigger LibreLogo to execute     python contained within a document a malicious document     could be constructed which would execute arbitrary     python commands silently without warning. In the fixed     versions, LibreLogo cannot be called from a document     event handler. This issue affects: Document Foundation     LibreOffice versions prior to 6.2.5.(CVE-2019-9848)

  - LibreOffice is typically bundled with LibreLogo, a     programmable turtle vector graphics script, which can     execute arbitrary python commands contained with the     document it is launched from. LibreOffice also has a     feature where documents can specify that pre-installed     scripts can be executed on various document script     events such as mouse-over, etc. Protection was added,     to address CVE-2019-9848, to block calling LibreLogo     from script event handers. However an insufficient url     validation vulnerability in LibreOffice allowed     malicious to bypass that protection and again trigger     calling LibreLogo from script event handlers. This     issue affects: Document Foundation LibreOffice versions     prior to 6.2.6.(CVE-2019-9850)

  - LibreOffice is typically bundled with LibreLogo, a     programmable turtle vector graphics script, which can     execute arbitrary python commands contained with the     document it is launched from. Protection was added, to     address CVE-2019-9848, to block calling LibreLogo from     document event script handers, e.g. mouse over. However     LibreOffice also has a separate feature where documents     can specify that pre-installed scripts can be executed     on various global script events such as document-open,     etc. In the fixed versions, global script event     handlers are validated equivalently to document script     event handlers. This issue affects: Document Foundation     LibreOffice versions prior to 6.2.6.(CVE-2019-9851)

  - LibreOffice has a feature where documents can specify     that pre-installed macros can be executed on various     script events such as mouse-over, document-open etc.
    Access is intended to be restricted to scripts under     the share/Scripts/python, user/Scripts/python     sub-directories of the LibreOffice install. Protection     was added, to address CVE-2018-16858, to avoid a     directory traversal attack where scripts in arbitrary     locations on the file system could be executed. However     this new protection could be bypassed by a URL encoding     attack. In the fixed versions, the parsed url     describing the script location is correctly encoded     before further processing. This issue affects: Document     Foundation LibreOffice versions prior to     6.2.6.(CVE-2019-9852)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the Linux kernel before     5.1.8. There is a double-free caused by a malicious USB     device in the drivers/usb/misc/rio500.c     driver.(CVE-2019-15212)

  - An issue was discovered in the Linux kernel before     5.2.3. There is a use-after-free caused by a malicious     USB device in the     drivers/media/usb/dvb-usb/dvb-usb-init.c     driver.(CVE-2019-15213)

  - An issue was discovered in the Linux kernel before     5.2.6. There is a use-after-free caused by a malicious     USB device in the drivers/media/usb/cpia2/cpia2_usb.c     driver.(CVE-2019-15215)

  - An issue was discovered in the Linux kernel before     5.0.14. There is a NULL pointer dereference caused by a     malicious USB device in the drivers/usb/misc/yurex.c     driver.(CVE-2019-15216)

  - An issue was discovered in the Linux kernel before     5.2.3. There is a NULL pointer dereference caused by a     malicious USB device in the     drivers/media/usb/zr364xx/zr364xx.c     driver.(CVE-2019-15217)

  - An issue was discovered in drivers/scsi/qedi/qedi_dbg.c     in the Linux kernel before 5.1.12. In the qedi_dbg_*     family of functions, there is an out-of-bounds     read.(CVE-2019-15090)

  - In the Linux kernel through 5.2.14 on the powerpc     platform, a local user can read vector registers of     other users' processes via a Facility Unavailable     exception. To exploit the venerability, a local user     starts a transaction (via the hardware transactional     memory instruction tbegin) and then accesses vector     registers. At some point, the vector registers will be     corrupted with the values from a different local Linux     process because of a missing     arch/powerpc/kernel/process.c check.(CVE-2019-15030)

  - In the Linux kernel through 5.2.14 on the powerpc     platform, a local user can read vector registers of     other users' processes via an interrupt. To exploit the     venerability, a local user starts a transaction (via     the hardware transactional memory instruction tbegin)     and then accesses vector registers. At some point, the     vector registers will be corrupted with the values from     a different local Linux process, because MSR_TM_ACTIVE     is misused in     arch/powerpc/kernel/process.c.(CVE-2019-15031)

  - An out-of-bounds access issue was found in the Linux     kernel, all versions through 5.3, in the way Linux     kernel's KVM hypervisor implements the Coalesced MMIO     write operation. It operates on an MMIO ring buffer     'struct kvm_coalesced_mmio' object, wherein write     indices 'ring->first' and 'ring->last' value could be     supplied by a host user-space process. An unprivileged     host user or process with access to '/dev/kvm' device     could use this flaw to crash the host kernel, resulting     in a denial of service or potentially escalating     privileges on the system.(CVE-2019-14821)

  - A buffer overflow flaw was found, in versions from     2.6.34 to 5.2.x, in the way Linux kernel's vhost     functionality that translates virtqueue buffers to     IOVs, logged the buffer descriptors during migration. A     privileged guest user able to pass descriptors with     invalid length to the host when migration is underway,     could use this flaw to increase their privileges on the     host.(CVE-2019-14835)

  - An issue was discovered in the Linux kernel before     5.0.9. There is a NULL pointer dereference for a pf     data structure if alloc_disk fails in     drivers/block/paride/pf.c.(CVE-2019-15922)

  - An issue was discovered in the Linux kernel before     5.0.10. SMB2_negotiate in fs/cifs/smb2pdu.c has an     out-of-bounds read because data structures are     incompletely updated after a change from smb30 to     smb21.(CVE-2019-15918)

  - An issue was discovered in the Linux kernel before     5.0.9. There is a NULL pointer dereference for a cd     data structure if alloc_disk fails in     drivers/block/paride/pf.c.(CVE-2019-15923)

  - An issue was discovered in the Linux kernel before     5.0.11. fm10k_init_module in     drivers/net/ethernet/intel/fm10k/fm10k_main.c has a     NULL pointer dereference because there is no -ENOMEM     upon an alloc_workqueue failure.(CVE-2019-15924)

  - An issue was discovered in the Linux kernel before     5.2.3. Out of bounds access exists in the functions     ath6kl_wmi_pstream_timeout_event_rx and     ath6kl_wmi_cac_event_rx in the file     drivers/net/wireless/ath/ath6kl/wmi.c.(CVE-2019-15926)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A vulnerability was found in Apache HTTP Server 2.4.0     to 2.4.38. When the path component of a request URL     contains multiple consecutive slashes ('/'), directives     such as LocationMatch and RewriteRule must account for     duplicates in regular expressions while other aspects     of the servers processing will implicitly collapse     them.(CVE-2019-0220)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the gvfs packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in GNOME gvfs 1.29.4 through     1.41.2. daemon/gvfsbackendadmin.c mishandles file     ownership because setfsuid is not used.(CVE-2019-12447)

  - An issue was discovered in GNOME gvfs 1.29.4 through     1.41.2. daemon/gvfsbackendadmin.c has race conditions     because the admin backend doesn't implement     query_info_on_read/write.(CVE-2019-12448)

  - An issue was discovered in GNOME gvfs 1.29.4 through     1.41.2. daemon/gvfsbackendadmin.c mishandles a file's     user and group ownership during move (and copy with     G_FILE_COPY_ALL_METADATA) operations from admin:// to     file:// URIs, because root privileges are     unavailable.(CVE-2019-12449)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Some HTTP/2 implementations are vulnerable to ping     floods, potentially leading to a denial of service. The     attacker sends continual pings to an HTTP/2 peer,     causing the peer to build an internal queue of     responses. Depending on how efficiently this data is     queued, this can consume excess CPU, memory, or     both.(CVE-2019-9512)

  - Some HTTP/2 implementations are vulnerable to a reset     flood, potentially leading to a denial of service. The     attacker opens a number of streams and sends an invalid     request over each stream that should solicit a stream     of RST_STREAM frames from the peer. Depending on how     the peer queues the RST_STREAM frames, this can consume     excess memory, CPU, or both.(CVE-2019-9514)

  - net/url in Go before 1.11.13 and 1.12.x before 1.12.8     mishandles malformed hosts in URLs, leading to an     authorization bypass in some applications. This is     related to a Host field with a suffix appearing in     neither Hostname() nor Port(), and is related to a     non-numeric port number. For example, an attacker can     compose a crafted javascript:// URL that results in a     hostname of google.com.(CVE-2019-14809)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glib2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0     through 2.61.1 does not properly restrict file     permissions while a copy operation is in progress.
    Instead, default permissions are used.(CVE-2019-12450)

  - The keyfile settings backend in GNOME GLib (aka     glib2.0) before 2.60.0 creates directories using     g_file_make_directory_with_parents (kfsb->dir, NULL,     NULL) and files using g_file_replace_contents     (kfsb->file, contents, length, NULL, FALSE,     G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL).
    Consequently, it does not properly restrict directory     (and file) permissions. Instead, for directories, 0777     permissions are used; for files, default file     permissions are used.(CVE-2019-13012)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was found that the .buildfont1 procedure did not     properly secure its privileged calls, enabling scripts     to bypass `-dSAFER` restrictions. An attacker could     abuse this flaw by creating a specially crafted     PostScript file that could escalate privileges and     access files outside of restricted     areas.(CVE-2019-10216)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the gettext packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An issue was discovered in GNU gettext 0.19.8. There is     a double free in default_add_message in read-catalog.c,     related to an invalid free in po_gram_parse in     po-gram-gen.y, as demonstrated by     lt-msgfmt.(CVE-2018-18751)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the gd package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - When using the gdImageCreateFromXbm() function in the     GD Graphics Library (aka LibGD) 2.2.5, as used in the     PHP GD extension in PHP versions 7.1.x below 7.1.30,     7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is     possible to supply data that will cause the function to     use the value of uninitialized variable. This may lead     to disclosing contents of the stack that has been left     there by previous code.(CVE-2019-11038)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the gcc packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The POWER9 backend in GNU Compiler Collection (GCC)     before version 10 could optimize multiple calls of the
    __builtin_darn intrinsic into a single call, thus     reducing the entropy of the random number generator.
    This occurred because a volatile operation was not     specified. For example, within a single execution of a     program, the output of every __builtin_darn() call may     be the same.(CVE-2019-15847)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the exiv2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In Exiv2 before v0.27.2, there is an integer overflow     vulnerability in the WebPImage::getHeaderOffset     function in webpimage.cpp. It can lead to a buffer     overflow vulnerability and a crash.(CVE-2019-14982)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the dovecot packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2     (and Pigeonhole before 0.5.7.2), protocol processing     can fail for quoted strings. This occurs because '\0'     characters are mishandled, and can lead to     out-of-bounds writes and remote code     execution.(CVE-2019-11500)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - CUPS printing system provides a portable printing layer     for UNIX(r) operating systems. It has been developed by     Apple Inc.to promote a standard printing solution for     all UNIX vendors and users.CUPS provides the System V     and Berkeley command-line interfaces.

  - Security fix(es):

  - cups: stack-buffer-overflow in libcups's asn1_get_type     function.(CVE-2019-8675)

  - cups: stack-buffer-overflow in libcups's asn1_get_type     function.(CVE-2019-8696)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - GNU binutils gold gold v1.11-v1.16 (GNU binutils     v2.21-v2.31.1) is affected by: Improper Input     Validation, Signed/Unsigned Comparison, Out-of-bounds     Read. The impact is: Denial of service. The component     is: gold/fileread.cc:497, elfcpp/elfcpp_file.h:644. The     attack vector is: An ELF file with an invalid e_shoff     header field must be opened.(CVE-2019-1010204)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the Linux kernel before     4.18.7. In block/blk-core.c, there is an
    __blk_drain_queue() use-after-free because a certain     error case is mishandled.(CVE-2018-20856)

  - In the Linux kernel before 5.1.7, a device can be     tracked by an attacker using the IP ID values the     kernel produces for connection-less protocols (e.g.,     UDP and ICMP). When such traffic is sent to multiple     destination IP addresses, it is possible to obtain hash     collisions (of indices to the counter array) and     thereby obtain the hashing key (via enumeration). An     attack may be conducted by hosting a crafted web page     that uses WebRTC or gQUIC to force UDP traffic to     attacker-controlled IP addresses.(CVE-2019-10638)

  - The Linux kernel 4.x (starting from 4.1) and 5.x before     5.0.8 allows Information Exposure (partial kernel     address disclosure), leading to a KASLR bypass.
    Specifically, it is possible to extract the KASLR     kernel image offset using the IP ID values the kernel     produces for connection-less protocols (e.g., UDP and     ICMP). When such traffic is sent to multiple     destination IP addresses, it is possible to obtain hash     collisions (of indices to the counter array) and     thereby obtain the hashing key (via enumeration). This     key contains enough bits from a kernel address (of a     static variable) so when the key is extracted (via     enumeration), the offset of the kernel image is     exposed. This attack can be carried out remotely, by     the attacker forcing the target device to send UDP or     ICMP (or certain other) traffic to attacker-controlled     IP addresses. Forcing a server to send UDP traffic is     trivial if the server is a DNS server. ICMP traffic is     trivial if the server answers ICMP Echo requests     (ping). For client targets, if the target visits the     attacker's web page, then WebRTC or gQUIC can be used     to force UDP traffic to attacker-controlled IP     addresses.(CVE-2019-10639)

  - The Linux kernel was found vulnerable to an integer     overflow in the     drivers/video/fbdev/uvesafb.c:uvesafb_setcmap()     function. The vulnerability could result in local     attackers being able to crash the kernel or potentially     elevate privileges.(CVE-2018-13406)

  - The SCTP socket buffer used by a userspace application     is not accounted by the cgroups subsystem. An attacker     can use this flaw to cause a denial of service     attack.(CVE-2019-3874)

  - The Linux kernel before 5.1-rc5 allows page->_refcount     reference count overflow, with resultant use-after-free     issues, if about 140 GiB of RAM exists. This is related     to fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h,     kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It     can occur with FUSE requests.(CVE-2019-11487)

  - A flaw was found in the Linux kernel's implementation     of ext4 extent management. The kernel doesn't correctly     initialize memory regions in the extent tree block     which may be exported to a local user to obtain     sensitive information by reading empty/uninitialized     data from the filesystem.(CVE-2019-11833)

  - A flaw was found in the Linux kernel's implementation     of the Bluetooth Human Interface Device Protocol     (HIDP). A local attacker with access permissions to the     Bluetooth device can issue an IOCTL which will trigger     the do_hidp_sock_ioctl function in     net/bluetooth/hidp/sock.c.c. This function can leak     potentially sensitive information from the kernel stack     memory via a HIDPCONNADD command because a name field     may not be correctly NULL terminated.(CVE-2019-11884)

  - The Linux kernel is vulnerable to an out-of-bounds read     in ext4/balloc.c:ext4_valid_block_bitmap() function. An     attacker could trick a legitimate user or a privileged     attacker could exploit this by mounting a crafted ext4     image to cause a crash.(CVE-2018-1093)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libssh package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A vulnerability was found in libssh's server-side state     machine before versions 0.7.6 and 0.8.4. A malicious     client could create channels without first performing     authentication, resulting in unauthorized     access.(CVE-2018-10933)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The rate limiting feature in NTP 4.x before 4.2.8p4 and     4.3.x before 4.3.77 allows remote attackers to have     unspecified impact via a large number of crafted     requests.

  - Mitigation:Do not add the 'limited' configuration     option to any restrict lines in the ntp.conf     file.(CVE-2015-7705)

  - The protocol engine in ntp 4.2.6 before 4.2.8p11 allows     a remote attackers to cause a denial of service     (disruption) by continually sending a packet with a     zero-origin timestamp and source IP address of the     'other side' of an interleaved association causing the     victim ntpd to reset its association(CVE-2018-7185)

  - The ntpq saveconfig command in NTP 4.1.2, 4.2.x before     4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not     properly filter special characters, which allows     attackers to cause unspecified impact via a crafted     filename.(CVE-2015-7976)

  - ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before     4.3.77 allows remote authenticated users to cause a     denial of service (infinite loop or crash) by pointing     the key file at the log file.

  - Mitigation:Disable NTP remote configuration or limit     this feature to trusted users to effectively mitigate     this risk(CVE-2015-7850)

  - The datalen parameter in the refclock driver in NTP     4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows     remote attackers to execute arbitrary code or cause a     denial of service (crash) via a negative input     value.(CVE-2015-7853)

  - Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4,     and 4.3.x before 4.3.77 allows remote attackers to     bypass authentication.(CVE-2015-7871)

  - The decodenetnum function in ntpd in NTP 4.2.x before     4.2.8p4, and 4.3.x before 4.3.77 allows remote     attackers to cause a denial of service (assertion     failure) via a 6 or mode 7 packet containing a long     data value.(CVE-2015-7855)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the freeradius package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was discovered freeradius does not correctly     configure logrotate, allowing a local attacker who     already has control of the radiusd user to escalate his     privileges to root, by tricking logrotate into writing     a radiusd-writable file to a directory normally     inaccessible by the radiusd user.(CVE-2019-10143)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the graphviz packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The agroot() function in cgraph\obj.c in libcgraph.a in     Graphviz 2.39.20160612.1140 has a NULL pointer     dereference, as demonstrated by     graphml2gv.(CVE-2019-11023)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the expat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In libexpat in Expat before 2.2.7, XML input including     XML names that contain a large number of colons could     make the XML parser consume a high amount of RAM and     CPU resources while processing (enough to be usable for     denial-of-service attacks).(CVE-2018-20843)

  - ( Multiple integer overflows in the XML_GetBuffer     function in Expat through 2.1.0, as used in Google     Chrome before 44.0.2403.89 and other products, allow     remote attackers to cause a denial of service     (heap-based buffer overflow) or possibly have     unspecified other impact via crafted XML data, a     related issue to CVE-2015-2716.(CVE-2015-1283)

  - The overflow protection in Expat is removed by     compilers with certain optimization settings, which     allows remote attackers to cause a denial of service     (crash) or possibly execute arbitrary code via crafted     XML data. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2015-1283 and     CVE-2015-2716.(CVE-2016-4472)

  - The XML parser in Expat does not use sufficient entropy     for hash initialization, which allows context-dependent     attackers to cause a denial of service (CPU     consumption) via crafted identifiers in an XML     document. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2012-0876.(CVE-2016-5300)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the texlive packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - TeX Live allows remote attackers to execute arbitrary     commands by leveraging inclusion of mpost in     shell_escape_commands in the texmf.cnf config     file.(CVE-2016-10243)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Blkid in util-linux before 2.26rc-1 allows local users     to execute arbitrary code.(CVE-2014-9114)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - SQLite3 from 3.6.0 to and including 3.27.2 is     vulnerable to heap out-of-bound read in the rtreenode()     function when handling invalid rtree     tables.(CVE-2019-8457)

  - The getNodeSize function in ext/rtree/rtree.c in SQLite     through 3.19.3, as used in GDAL and other products,     mishandles undersized RTree blobs in a crafted     database, leading to a heap-based buffer over-read or     possibly unspecified other impact.(CVE-2017-10989)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the zip package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Info-ZIP Zip 3.0, when the -T and -TT command-line     options are used, allows attackers to cause a denial of     service (invalid free and application crash) or     possibly have unspecified other impact because of an     off-by-one error. NOTE: it is unclear whether there are     realistic scenarios in which an untrusted party     controls the -TT value, given that the entire purpose     of -TT is execution of arbitrary     commands.(CVE-2018-13410)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Double free vulnerability in MIT Kerberos 5 (aka krb5)     allows attackers to have unspecified impact via vectors     involving automatic deletion of security contexts on     error.(CVE-2017-11462)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the bzip2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - BZ2_decompress in decompress.c in bzip2 through 1.0.6     has an out-of-bounds write when there are many     selectors.(CVE-2019-12900)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In LibTIFF 4.0.8, there is a heap-based buffer overflow     in the t2p_write_pdf function in tools/tiff2pdf.c. This     heap overflow could lead to different damages. For     example, a crafted TIFF document can lead to an     out-of-bounds read in TIFFCleanup, an invalid free in     TIFFClose or t2p_free, memory corruption in     t2p_readwrite_pdf_image, or a double free in t2p_free.
    Given these possibilities, it probably could cause     arbitrary code execution.(CVE-2017-9935)

  - LibTIFF before 4.0.6 mishandles the reading of TIFF     files, as demonstrated by a heap-based buffer over-read     in the ReadTIFFImage function in coders/tiff.c in     GraphicsMagick 1.3.27.(CVE-2018-5360)

  - tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows     remote attackers to cause a denial of service     (TIFFSetupStrips heap-based buffer overflow and     application crash) or possibly have unspecified other     impact via a crafted TIFF file.(CVE-2017-17095)

  - TIFFWriteScanline in tif_write.c in LibTIFF 3.8.2 has a     heap-based buffer over-read, as demonstrated by     bmp2tiff.(CVE-2018-10779)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the wpa_supplicant package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The implementations of SAE in hostapd and     wpa_supplicant are vulnerable to side channel attacks     as a result of observable timing differences and cache     access patterns. An attacker may be able to gain leaked     information from a side channel attack that can be used     for full password recovery. Both hostapd with SAE     support and wpa_supplicant with SAE support prior to     and including version 2.7 are affected.(CVE-2019-9494)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A heap buffer overflow in the TFTP receiving code     allows for DoS or arbitrary code execution in libcurl     versions 7.19.4 through 7.64.1.(CVE-2019-5436)

  - The ourWriteOut function in tool_writeout.c in curl     7.53.1 might allow physically proximate attackers to     obtain sensitive information from process memory in     opportunistic circumstances by reading a workstation     screen during use of a --write-out argument ending in a     '%' character, which leads to a heap-based buffer     over-read.(CVE-2017-7407)

  - Curl versions 7.14.1 through 7.61.1 are vulnerable to a     heap-based buffer over-read in the tool_msgs.c:voutf()     function that may result in information exposure and     denial of service.(CVE-2018-16842)

  - The ConnectionExists function in lib/url.c in libcurl     before 7.47.0 does not properly re-use     NTLM-authenticated proxy connections, which might allow     remote attackers to authenticate as other users via a     request, a similar issue to     CVE-2014-0015.(CVE-2016-0755)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in Squid 3.3.9 through 3.5.28     and 4.x through 4.7. When Squid is configured to use     Digest authentication, it parses the header     Proxy-Authorization. It searches for certain tokens     such as domain, uri, and qop. Squid checks if this     token's value starts with a quote and ends with one. If     so, it performs a memcpy of its length minus 2. Squid     never checks whether the value is just a single quote     (which would satisfy its requirements), leading to a     memcpy of its length minus 1.(CVE-2019-12525)

  - The cachemgr.cgi web module of Squid through 4.7 has     XSS via the user_name or auth     parameter.(CVE-2019-13345)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A vulnerability was found in sssd where, if a user was     configured with no home directory set, sssd would     return '/' (the root directory) instead of '' (the     empty string / no home directory). This could impact     services that restrict the user's filesystem access to     within their home directory through     chroot().(CVE-2019-3811)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libnl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An integer overflow leading to a heap-buffer overflow     was found in the libnl library. An attacker could use     this flaw to cause an application compiled with libnl     to crash or possibly execute arbitrary code in the     context of the user running such an application.
    (CVE-2017-0553)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the flex package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Heap-based buffer overflow in the yy_get_next_buffer     function in Flex before 2.6.1 might allow     context-dependent attackers to cause a denial of     service or possibly execute arbitrary code via vectors     involving num_to_read.(CVE-2016-6354)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libidn package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The idna_to_ascii_4i function in lib/idna.c in libidn     before 1.33 allows context-dependent attackers to cause     a denial of service (out-of-bounds read and crash) via     64 bytes of input.(CVE-2016-6261)

  - The stringprep_utf8_nfkc_normalize function in     lib/nfkc.c in libidn before 1.33 allows     context-dependent attackers to cause a denial of     service (out-of-bounds read and crash) via crafted     UTF-8 data.(CVE-2016-6263)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libpng packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - libpng before 1.6.32 does not properly check the length     of chunks against the user limit.(CVE-2017-12652)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The SSI printenv command in Apache Tomcat 9.0.0.M1 to     9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes     user provided data without escaping and is, therefore,     vulnerable to XSS. SSI is disabled by default. The     printenv command is intended for debugging and is     unlikely to be present in a production     website.(CVE-2019-0221)

  - When the default servlet in Apache Tomcat versions     9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to     7.0.90 returned a redirect to a directory (e.g.
    redirecting to '/foo/' when the user requested '/foo')     a specially crafted URL could be used to cause the     redirect to be generated to any URI of the attackers     choice.(CVE-2018-11784)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the bubblewrap package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - bubblewrap.c in Bubblewrap before 0.3.3 misuses     temporary directories in /tmp as a mount point. In some     particular configurations (related to XDG_RUNTIME_DIR),     a local attacker may abuse this flaw to prevent other     users from executing bubblewrap or potentially execute     code.(CVE-2019-12439)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Severity
129454	EulerOS 2.0 SP8 : wavpack (EulerOS-SA-2019-2095)	Medium
129453	EulerOS 2.0 SP8 : tomcat (EulerOS-SA-2019-2094)	Medium
129452	EulerOS 2.0 SP8 : squid (EulerOS-SA-2019-2093)	High
129451	EulerOS 2.0 SP8 : squashfs-tools (EulerOS-SA-2019-2092)	Medium
129450	EulerOS 2.0 SP8 : python3 (EulerOS-SA-2019-2091)	Medium
129449	EulerOS 2.0 SP8 : postgresql (EulerOS-SA-2019-2090)	High
129448	EulerOS 2.0 SP8 : php (EulerOS-SA-2019-2089)	Medium
129447	EulerOS 2.0 SP8 : pango (EulerOS-SA-2019-2088)	High
129446	EulerOS 2.0 SP8 : openldap (EulerOS-SA-2019-2087)	Low
129445	EulerOS 2.0 SP8 : oniguruma (EulerOS-SA-2019-2086)	High
129444	EulerOS 2.0 SP8 : nmap (EulerOS-SA-2019-2085)	Medium
129443	EulerOS 2.0 SP8 : nginx (EulerOS-SA-2019-2084)	High
129442	EulerOS 2.0 SP8 : nghttp2 (EulerOS-SA-2019-2083)	High
129441	EulerOS 2.0 SP8 : libreoffice (EulerOS-SA-2019-2082)	High
129440	EulerOS 2.0 SP8 : kernel (EulerOS-SA-2019-2081)	High
129439	EulerOS 2.0 SP8 : httpd (EulerOS-SA-2019-2080)	Medium
129438	EulerOS 2.0 SP8 : gvfs (EulerOS-SA-2019-2079)	Medium
129437	EulerOS 2.0 SP8 : golang (EulerOS-SA-2019-2078)	High
129436	EulerOS 2.0 SP8 : glib2 (EulerOS-SA-2019-2077)	High
129435	EulerOS 2.0 SP8 : ghostscript (EulerOS-SA-2019-2076)	High
129434	EulerOS 2.0 SP8 : gettext (EulerOS-SA-2019-2075)	High
129433	EulerOS 2.0 SP8 : gd (EulerOS-SA-2019-2074)	Medium
129432	EulerOS 2.0 SP8 : gcc (EulerOS-SA-2019-2073)	Medium
129431	EulerOS 2.0 SP8 : exiv2 (EulerOS-SA-2019-2072)	Medium
129430	EulerOS 2.0 SP8 : dovecot (EulerOS-SA-2019-2071)	High
129429	EulerOS 2.0 SP8 : cups (EulerOS-SA-2019-2070)	Low
129428	EulerOS 2.0 SP8 : binutils (EulerOS-SA-2019-2069)	Medium
129261	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2019-2068)	High
129260	EulerOS 2.0 SP3 : libssh (EulerOS-SA-2019-2067)	Medium
129259	EulerOS 2.0 SP3 : ntp (EulerOS-SA-2019-2066)	High
129258	EulerOS 2.0 SP3 : freeradius (EulerOS-SA-2019-2065)	Medium
129257	EulerOS 2.0 SP3 : graphviz (EulerOS-SA-2019-2064)	Medium
129256	EulerOS 2.0 SP3 : expat (EulerOS-SA-2019-2063)	High
129255	EulerOS 2.0 SP3 : texlive (EulerOS-SA-2019-2062)	High
129254	EulerOS 2.0 SP3 : util-linux (EulerOS-SA-2019-2061)	High
129253	EulerOS 2.0 SP3 : sqlite (EulerOS-SA-2019-2060)	High
129252	EulerOS 2.0 SP3 : zip (EulerOS-SA-2019-2059)	High
129251	EulerOS 2.0 SP3 : krb5 (EulerOS-SA-2019-2058)	High
129250	EulerOS 2.0 SP3 : bzip2 (EulerOS-SA-2019-2057)	High
129249	EulerOS 2.0 SP3 : libtiff (EulerOS-SA-2019-2056)	Medium
129248	EulerOS 2.0 SP3 : wpa_supplicant (EulerOS-SA-2019-2055)	Medium
129247	EulerOS 2.0 SP3 : curl (EulerOS-SA-2019-2054)	Medium
129246	EulerOS 2.0 SP3 : squid (EulerOS-SA-2019-2053)	High
129245	EulerOS 2.0 SP3 : sssd (EulerOS-SA-2019-2052)	Low
129244	EulerOS 2.0 SP3 : libnl (EulerOS-SA-2019-2051)	High
129243	EulerOS 2.0 SP3 : flex (EulerOS-SA-2019-2050)	High
129242	EulerOS 2.0 SP3 : libidn (EulerOS-SA-2019-2049)	Medium
129241	EulerOS 2.0 SP3 : libpng (EulerOS-SA-2019-2048)	High
129240	EulerOS 2.0 SP3 : tomcat (EulerOS-SA-2019-2047)	Medium
129239	EulerOS 2.0 SP3 : bubblewrap (EulerOS-SA-2019-2046)	Medium

Huawei Local Security Checks Family for Nessus