According to the versions of the qemu packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Quick Emulator (Qemu) built with the VirtFS, host     directory sharing via Plan 9 File System(9pfs) support,     is vulnerable to an improper access control issue. It     could occur while accessing virtfs metadata files in     mapped-file security mode. A guest user could use this     flaw to escalate their privileges inside     guest.(CVE-2017-7493)

  - qemu-bridge-helper.c in QEMU 4.0.0 does not ensure that     a network interface name (obtained from bridge.conf or     a --br=bridge option) is limited to the IFNAMSIZ size,     which can lead to an ACL bypass.(CVE-2019-13164)

  - Qemu has a Buffer Overflow in pcnet_receive in     hw/net/pcnet.c because an incorrect integer data type     is used.(CVE-2018-17962)

  - Buffer overflow in the 'megasas_mmio_write' function in     Qemu 2.9.0 allows remote attackers to have unspecified     impact via unknown vectors.(CVE-2017-8380)

  - qemu_deliver_packet_iov in net/net.c in Qemu accepts     packet sizes greater than INT_MAX, which allows     attackers to cause a denial of service or possibly have     unspecified other impact.(CVE-2018-17963)

  - In QEMU 3.1.0, load_device_tree in device_tree.c calls     the deprecated load_image function, which has a buffer     overflow risk.(CVE-2018-20815)

  - interface_release_resource in hw/display/qxl.c in QEMU     4.0.0 has a NULL pointer dereference.(CVE-2019-12155)

  - An issue was discovered in ide_dma_cb() in     hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest     system can crash the QEMU process in the host system     via a special SCSI_IOCTL_SEND_COMMAND. It hits an     assertion that implies that the size of successful DMA     transfers there must be a multiple of 512 (the size of     a sector). NOTE: a member of the QEMU security team     disputes the significance of this issue because a     'privileged guest user has many ways to cause similar     DoS effect, without triggering this     assert.'(CVE-2019-20175)

  - Use-after-free vulnerability in the sofree function in     slirp/socket.c in QEMU (aka Quick Emulator) allows     attackers to cause a denial of service (QEMU instance     crash) by leveraging failure to properly clear ifq_so     from pending packets.(CVE-2017-13711)

  - Qemu has a Buffer Overflow in rtl8139_do_receive in     hw/net/rtl8139.c because an incorrect integer data type     is used.(CVE-2018-17958)

  - ip_reass in ip_input.c in libslirp 4.0.0 has a     heap-based buffer overflow via a large packet because     it mishandles a case involving the first     fragment.(CVE-2019-14378)

  - m_cat in slirp/mbuf.c in Qemu has a heap-based buffer     overflow via incoming fragmented     datagrams.(CVE-2018-11806)

  - Memory leak in the audio/audio.c in QEMU (aka Quick     Emulator) allows remote attackers to cause a denial of     service (memory consumption) by repeatedly starting and     stopping audio capture.(CVE-2017-8309)

  - Memory leak in the keyboard input event handlers     support in QEMU (aka Quick Emulator) allows local guest     OS privileged users to cause a denial of service (host     memory consumption) by rapidly generating large     keyboard events.(CVE-2017-8379)

  - hw/input/ps2.c in Qemu does not validate 'rptr' and     'count' values during guest migration, leading to     out-of-bounds access(CVE-2017-16845)

  - The cirrus_invalidate_region function in     hw/display/cirrus_vga.c in Qemu allows local OS guest     privileged users to cause a denial of service     (out-of-bounds array access and QEMU process crash) via     vectors related to negative pitch.(CVE-2017-18030)

  - An out-of-bounds read/write access flaw was found in     the USB emulator of the QEMU in versions before 5.2.0.
    This issue occurs while processing USB packets from a     guest when USBDevice 'setup_len' exceeds its     'data_buf[4096]' in the do_token_in, do_token_out     routines. This flaw allows a guest user to crash the     QEMU process, resulting in a denial of service, or the     potential execution of arbitrary code with the     privileges of the QEMU process on the     host.(CVE-2020-14364)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the trousers package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in TrouSerS through 0.3.14. If     the tcsd daemon is started with root privileges instead     of by the tss user, it fails to drop the root gid     privilege when no longer needed.(CVE-2020-24330)

  - An issue was discovered in TrouSerS through 0.3.14. If     the tcsd daemon is started with root privileges, the     creation of the system.data file is prone to symlink     attacks. The tss user can be used to create or corrupt     existing files, which could possibly lead to a DoS     attack.(CVE-2020-24332)

  - An issue was discovered in TrouSerS through 0.3.14. If     the tcsd daemon is started with root privileges, the     tss user still has read and write access to the     /etc/tcsd.conf file (which contains various settings     related to this daemon).(CVE-2020-24331)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the xorg-x11-server packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in X.Org Server before xorg-x11-server     1.20.9. An Out-Of-Bounds access in XkbSetNames function     may lead to a privilege escalation vulnerability. The     highest threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-14345)

  - A flaw was found in X.Org Server before xorg-x11-server     1.20.9. An Integer underflow leading to heap-buffer     overflow may lead to a privilege escalation     vulnerability. The highest threat from this     vulnerability is to data confidentiality and integrity     as well as system availability.(CVE-2020-14361)

  - A flaw was found in xorg-x11-server before 1.20.9. An     integer underflow in the X input extension protocol     decoding in the X server may lead to arbitrary access     of memory contents. The highest threat from this     vulnerability is to data confidentiality and integrity     as well as system availability.(CVE-2020-14346)

  - A flaw was found in X.Org Server before xorg-x11-server     1.20.9. An Integer underflow leading to heap-buffer     overflow may lead to a privilege escalation     vulnerability. The highest threat from this     vulnerability is to data confidentiality and integrity     as well as system availability.(CVE-2020-14362)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A null pointer dereference flaw was found in samba's     Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this     flaw to crash the winbind service causing denial of     service.(CVE-2020-14323,CVE-2020-14318)

  - An elevation of privilege vulnerability exists when an     attacker establishes a vulnerable Netlogon secure     channel connection to a domain controller, using the     Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon     Elevation of Privilege Vulnerability'.(CVE-2020-1472)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the augeas package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - An information disclosure vulnerability in     silk/NLSF_stabilize.c in libopus in Mediaserver could     enable a local malicious application to access data     outside of its permission levels. This issue is rated     as Moderate because it could be used to access     sensitive data without permission. Product: Android.
    Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android     ID: A-31607432.(CVE-2017-0381)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In uvc_scan_chain_forward of uvc_driver.c, there is a     possible linked list corruption due to an unusual root     cause. This could lead to local escalation of privilege     in the kernel with no additional execution privileges     needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-111893654References: Upstream     kernel.(CVE-2020-0404)

  - A flaw was found in the Linux kernel in versions from     2.2.3 through 5.9.rc5. When changing screen size, an     out-of-bounds memory write can occur leading to memory     corruption or a denial of service. This highest threat     from this vulnerability is to system     availability.(CVE-2020-14390)

  - A TOCTOU mismatch in the NFS client code in the Linux     kernel before 5.8.3 could be used by local attackers to     corrupt memory or possibly have unspecified other     impact because a size check is in fs/nfs/nfs4proc.c     instead of fs/nfs/nfs4xdr.c, aka     CID-b4487b935452.(CVE-2020-25212)

  - A flaw was found in the Linux kernel before 5.9-rc4. A     failure of the file system metadata validator in XFS     can cause an inode with a valid, user-creatable     extended attribute to be flagged as corrupt. This can     lead to the filesystem being shutdown, or otherwise     rendered inaccessible until it is remounted, leading to     a denial of service. The highest threat from this     vulnerability is to system     availability.(CVE-2020-14385)

  - In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the     NFS server) can set incorrect permissions on new     filesystem objects when the filesystem lacks ACL     support, aka CID-22cf8419f131. This occurs because the     current umask is not considered.(CVE-2020-24394)

  - The rbd block device driver in drivers/block/rbd.c in     the Linux kernel through 5.8.9 used incomplete     permission checking for access to rbd devices, which     could be leveraged by local attackers to map or unmap     rbd block devices, aka     CID-f44d04e696fe.(CVE-2020-25284)

  - An issue was discovered in net/ipv4/sysctl_net_ipv4.c     in the Linux kernel before 5.0.11. There is a     net/ipv4/tcp_input.c signed integer overflow in     tcp_ack_update_rtt() when userspace writes a very large     integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading     to a denial of service or possibly unspecified other     impact, aka CID-19fad20d15a6.(CVE-2019-18805)

  - Insufficient input validation in i40e driver for     Intel(R) Ethernet 700 Series Controllers versions     before 7.0 may allow an authenticated user to     potentially enable a denial of service via local     access.(CVE-2019-0147)

  - Buffer overflow in i40e driver for Intel(R) Ethernet     700 Series Controllers versions before 7.0 may allow an     authenticated user to potentially enable an escalation     of privilege via local access.(CVE-2020-0145)

  - A race condition between hugetlb sysctl handlers in     mm/hugetlb.c in the Linux kernel before 5.8.8 could be     used by local attackers to corrupt memory, cause a NULL     pointer dereference, or possibly have unspecified other     impact, aka CID-17743798d812.(CVE-2020-25285)

  - A memory out-of-bounds read flaw was found in the Linux     kernel before 5.9-rc2 with the ext3/ext4 file system,     in the way it accesses a directory with broken     indexing. This flaw allows a local user to crash the     system if the directory exists. The highest threat from     this vulnerability is to system     availability.(CVE-2020-14314)

  - A missing CAP_NET_RAW check in NFC socket creation in     net/nfc/rawsock.c in the Linux kernel before 5.8.2     could be used by local attackers to create raw sockets,     bypassing security mechanisms, aka     CID-26896f01467a.(CVE-2020-26088)

  - A flaw was found in the HDLC_PPP module of the Linux     kernel in versions before 5.9-rc7. Memory corruption     and a read overflow is caused by improper input     validation in the ppp_cp_parse_cr function which can     cause the system to crash or cause a denial of service.
    The highest threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-25643)

  - The Linux kernel, as used in Red Hat Enterprise Linux     7, kernel-rt, and Enterprise MRG 2 and when booted with     UEFI Secure Boot enabled, allows local users to bypass     intended securelevel/secureboot restrictions by     leveraging improper handling of secure_boot flag across     kexec reboot.(CVE-2015-7837)

  - A flaw was found in the Linux kernel's implementation     of biovecs in versions before 5.9-rc7. A zero-length     biovec request issued by the block subsystem could     cause the kernel to enter an infinite loop, causing a     denial of service. This flaw allows a local attacker     with basic privileges to issue requests to a block     device, resulting in a denial of service. The highest     threat from this vulnerability is to system     availability.(CVE-2020-25641)

  - A flaw was found in the Linux kernel before 5.9-rc4.
    Memory corruption can be exploited to gain root     privileges from unprivileged processes. The highest     threat from this vulnerability is to data     confidentiality and integrity.(CVE-2020-14386)

  - A flaw was found in the Linux kernel in versions before     5.9-rc7. Traffic between two Geneve endpoints may be     unencrypted when IPsec is configured to encrypt traffic     for the specific UDP port used by the GENEVE tunnel     allowing anyone between the two endpoints to read the     traffic unencrypted. The main threat from this     vulnerability is to data     confidentiality.(CVE-2020-25645)

  - perf: Fix race in perf_mmap_close     function.(CVE-2020-14351)

  - An information leak flaw was found in the way the Linux     kernel's Bluetooth stack implementation handled     initialization of stack memory when handling certain     AMP packets. A remote attacker in adjacent range could     use this flaw to leak small portions of stack memory on     the system by sending a specially crafted AMP packets.
    The highest threat from this vulnerability is to data     confidentiality.(CVE-2020-12352)

  - A flaw was found in the way the Linux kernel Bluetooth     implementation handled L2CAP packets with A2MP CID. A     remote attacker in adjacent range could use this flaw     to crash the system causing denial of service or     potentially execute arbitrary code on the system by     sending a specially crafted L2CAP packet. The highest     threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-12351)

  - A heap buffer overflow flaw was found in the way the     Linux kernel's Bluetooth implementation processed     extended advertising report events. This flaw allows a     remote attacker in an adjacent range to crash the     system, causing a denial of service or to potentially     execute arbitrary code on the system by sending a     specially crafted Bluetooth packet. The highest threat     from this vulnerability is to confidentiality,     integrity, as well as system     availability.(CVE-2020-24490)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2020-25656)

  - In skb_to_mamac of networking.c, there is a possible     out of bounds write due to an integer overflow. This     could lead to local escalation of privilege with no     additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-143560807(CVE-2020-0432)

  - A slab-out-of-bounds read in fbcon in the Linux kernel     before 5.9.7 could be used by local attackers to read     privileged information or potentially crash the kernel,     aka CID-3c4e0dff2095. This occurs because     KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for     manipulations such as font height.(CVE-2020-28974)

  - A flaw memory leak in the Linux kernel performance     monitoring subsystem was found in the way if using     PERF_EVENT_IOC_SET_FILTER. A local user could use this     flaw to starve the resources causing denial of     service.(CVE-2020-25704)

  - A buffer over-read (at the framebuffer layer) in the     fbcon code in the Linux kernel before 5.8.15 could be     used by local attackers to read kernel memory, aka     CID-6735b4632def.(CVE-2020-28915)

  - There is a use-after-free problem seen due to a race     condition between the release of ptp_clock and cdev     while resource deallocation. When a (high privileged)     process allocates a ptp device file (like /dev/ptpX)     and voluntarily goes to sleep. During this time if the     underlying device is removed, it can cause an     exploitable condition as the process wakes up to     terminate and clean all attached files. The system     crashes due to the cdev structure being invalid (as     already freed) which is pointed to by the     inode.(CVE-2020-10690)

  - A device tracking vulnerability was found in the     flow_dissector feature in the Linux kernel. This flaw     occurs because the auto flowlabel of the UDP IPv6     packet relies on a 32-bit hashmd value as a secret, and     jhash (instead of siphash) is used. The hashmd value     remains the same starting from boot time and can be     inferred by an attacker.(CVE-2019-18282)

  - Use-after-free vulnerability in fs/block_dev.c in the     Linux kernel before 5.8 allows local users to gain     privileges or cause a denial of service by leveraging     improper access to a certain error     field.(CVE-2020-15436)

  - The Linux kernel before version 5.8 is vulnerable to a     NULL pointer dereference in     drivers/tty/serial/8250/8250_core.c:serial8250_isa_init
    _ports() that allows local users to cause a denial of     service by using the p->serial_in pointer which     uninitialized.(CVE-2020-15437)

  - An issue was discovered in kmem_cache_alloc_bulk in     mm/slub.c in the Linux kernel before 5.5.11. The     slowpath lacks the required TID increment, aka     CID-fd4d9c7d0c71.(CVE-2020-29370)

  - An issue was discovered in the Linux kernel before     5.2.6. On NUMA systems, the Linux fair scheduler has a     use-after-free in show_numa_stats() because NUMA fault     statistics are inappropriately freed, aka     CID-16d51a590a8c.(CVE-2019-20934)

  - An issue was discovered in romfs_dev_read in     fs/romfs/storage.c in the Linux kernel before 5.8.4.
    Uninitialized memory leaks to userspace, aka     CID-bcf85fcedfdd.(CVE-2020-29371)

  - An issue was discovered in the Linux kernel before     5.7.3, related to mm/gup.c and mm/huge_memory.c. The     get_user_pages (aka gup) implementation, when used for     a copy-on-write page, does not properly consider the     semantics of read operations and therefore can grant     unintended write access, aka     CID-17839856fd58.(CVE-2020-29374)

  - A flaw was found in the way RTAS handled memory     accesses in userspace to kernel communication. On a     locked down (usually due to Secure Boot) guest system     running on top of PowerVM or KVM hypervisors (pseries     platform) a root like local user could use this flaw to     further increase their privileges to that of a running     kernel.(CVE-2020-27777)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libvirt packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A double free memory issue was found to occur in the     libvirt API, in versions before 6.8.0, responsible for     requesting information about network interfaces of a     running QEMU domain. This flaw affects the polkit     access control driver. Specifically, clients connecting     to the read-write socket with limited ACL permissions     could use this flaw to crash the libvirt daemon,     resulting in a denial of service, or potentially     escalate their privileges on the system. The highest     threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-25637)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the spdk package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in dpdk in versions before 18.11.10     and before 19.11.5. A flawed bounds checking in the     copy_data function leads to a buffer overflow allowing     an attacker in a virtual machine to write arbitrary     data to any address in the vhost_crypto application.
    The highest threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-14374)

  - A flaw was found in dpdk in versions before 18.11.10     and before 19.11.5. Virtio ring descriptors, and the     data they describe are in a region of memory accessible     by from both the virtual machine and the host. An     attacker in a VM can change the contents of the memory     after vhost_crypto has validated it. The highest threat     from this vulnerability is to data confidentiality and     integrity as well as system     availability.(CVE-2020-14375)

  - A flaw was found in dpdk in versions before 18.11.10     and before 19.11.5. A lack of bounds checking when     copying iv_data from the VM guest memory into host     memory can lead to a large buffer overflow. The highest     threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-14376)

  - A flaw was found in dpdk in versions before 18.11.10     and before 19.11.5. A complete lack of validation of     attacker-controlled parameters can lead to a buffer     over read. The results of the over read are then     written back to the guest virtual machine memory. This     vulnerability can be used by an attacker in a virtual     machine to read significant amounts of host memory. The     highest threat from this vulnerability is to data     confidentiality and system     availability.(CVE-2020-14377)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the qemu-kvm packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In QEMU through 5.0.0, an integer overflow was found in     the SM501 display driver implementation. This flaw     occurs in the COPY_AREA macro while handling MMIO write     operations through the sm501_2d_engine_write()     callback. A local attacker could abuse this flaw to     crash the QEMU process in sm501_2d_operation() in     hw/display/sm501.c on the host, resulting in a denial     of service.(CVE-2020-12829)

  - The qemu-nbd server in QEMU (aka Quick Emulator), when     built with the Network Block Device (NBD) Server     support, allows remote attackers to cause a denial of     service (segmentation fault and server crash) by     leveraging failure to ensure that all initialization     occurs before talking to a client in the nbd_negotiate     function.(CVE-2017-9524)

  - A reachable assertion issue was found in the USB EHCI     emulation code of QEMU. It could occur while processing     USB requests due to missing handling of DMA memory map     failure. A malicious privileged user within the guest     may abuse this flaw to send bogus USB requests and     crash the QEMU process on the host, resulting in a     denial of service.(CVE-2020-25723)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the perl-DBD-MySQL package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - There is a vulnerability of type use-after-free     affecting DBD::mysql (aka DBD-mysql or the Database     Interface (DBI) MySQL driver for Perl) 3.x and 4.x     before 4.041 when used with     mysql_server_prepare=1.(CVE-2016-1251)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ghostscript packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A buffer overflow vulnerability in lprn_is_black() in     contrib/lips4/gdevlprn.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a     denial of service via a crafted PDF file. This is fixed     in v9.51.(CVE-2020-16287)

  - A buffer overflow vulnerability in     pj_common_print_page() in devices/gdevpjet.c of Artifex     Software GhostScript v9.50 allows a remote attacker to     cause a denial of service via a crafted PDF file. This     is fixed in v9.51.(CVE-2020-16288)

  - A buffer overflow vulnerability in cif_print_page() in     devices/gdevcif.c of Artifex Software GhostScript v9.50     allows a remote attacker to cause a denial of service     via a crafted PDF file. This is fixed in     v9.51.(CVE-2020-16289)

  - A buffer overflow vulnerability in     jetp3852_print_page() in devices/gdev3852.c of Artifex     Software GhostScript v9.50 allows a remote attacker to     cause a denial of service via a crafted PDF file. This     is fixed in v9.51.(CVE-2020-16290)

  - A buffer overflow vulnerability in contrib/gdevdj9.c of     Artifex Software GhostScript v9.50 allows a remote     attacker to cause a denial of service via a crafted PDF     file. This is fixed in v9.51.(CVE-2020-16291)

  - A buffer overflow vulnerability in mj_raster_cmd() in     contrib/japanese/gdevmjc.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a     denial of service via a crafted PDF file. This is fixed     in v9.51.(CVE-2020-16292)

  - A buffer overflow vulnerability in epsc_print_page() in     devices/gdevepsc.c of Artifex Software GhostScript     v9.50 allows a remote attacker to cause a denial of     service via a crafted PDF file. This is fixed in     v9.51.(CVE-2020-16294)

  - A null pointer dereference vulnerability in     clj_media_size() in devices/gdevclj.c of Artifex     Software GhostScript v9.50 allows a remote attacker to     cause a denial of service via a crafted PDF file. This     is fixed in v9.51.(CVE-2020-16295)

  - A buffer overflow vulnerability in GetNumWrongData() in     contrib/lips4/gdevlips.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a     denial of service via a crafted PDF file. This is fixed     in v9.51.(CVE-2020-16296)

  - A buffer overflow vulnerability in     FloydSteinbergDitheringC() in contrib/gdevbjca.c of     Artifex Software GhostScript v9.50 allows a remote     attacker to cause a denial of service via a crafted PDF     file. This is fixed in v9.51.(CVE-2020-16297)

  - A buffer overflow vulnerability in mj_color_correct()     in contrib/japanese/gdevmjc.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a     denial of service via a crafted PDF file. This is fixed     in v9.51.(CVE-2020-16298)

  - A Division by Zero vulnerability in bj10v_print_page()     in contrib/japanese/gdev10v.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a     denial of service via a crafted PDF file. This is fixed     in v9.51.(CVE-2020-16299)

  - A buffer overflow vulnerability in tiff12_print_page()     in devices/gdevtfnx.c of Artifex Software GhostScript     v9.50 allows a remote attacker to cause a denial of     service via a crafted PDF file. This is fixed in     v9.51.(CVE-2020-16300)

  - A buffer overflow vulnerability in okiibm_print_page1()     in devices/gdevokii.c of Artifex Software GhostScript     v9.50 allows a remote attacker to cause a denial of     service via a crafted PDF file. This is fixed in     v9.51.(CVE-2020-16301)

  - A buffer overflow vulnerability in     jetp3852_print_page() in devices/gdev3852.c of Artifex     Software GhostScript v9.50 allows a remote attacker to     escalate privileges via a crafted PDF file. This is     fixed in v9.51.(CVE-2020-16302)

  - A buffer overflow vulnerability in pcx_write_rle() in     contrib/japanese/gdev10v.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a     denial of service via a crafted PDF file. This is fixed     in v9.51.(CVE-2020-16305)

  - A buffer overflow vulnerability in p_print_image() in     devices/gdevcdj.c of Artifex Software GhostScript v9.50     allows a remote attacker to cause a denial of service     via a crafted PDF file. This is fixed in     v9.51.(CVE-2020-16308)

  - A buffer overflow vulnerability in     lxm5700m_print_page() in devices/gdevlxm.c of Artifex     Software GhostScript v9.50 allows a remote attacker to     cause a denial of service via a crafted eps file. This     is fixed in v9.51.(CVE-2020-16309)

  - A division by zero vulnerability in dot24_print_page()     in devices/gdevdm24.c of Artifex Software GhostScript     v9.50 allows a remote attacker to cause a denial of     service via a crafted PDF file. This is fixed in     v9.51.(CVE-2020-16310)

  - A buffer overflow vulnerability in GetNumSameData() in     contrib/lips4/gdevlips.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a     denial of service via a crafted PDF file. This is fixed     in v9.51.(CVE-2020-17538)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the mariadb packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - Vulnerability in the MySQL Client product of Oracle     MySQL (component: C API). Supported versions that are     affected are 5.6.46 and prior, 5.7.28 and prior and     8.0.18 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via     multiple protocols to compromise MySQL Client.
    Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Client.
    (CVE-2020-2574)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the cifs-utils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - It was found that cifs-utils' mount.cifs was invoking a     shell when requesting the Samba password, which could     be used to inject arbitrary commands. An attacker able     to invoke mount.cifs with special permission, such as     via sudo rules, could use this flaw to escalate their     privileges.(CVE-2020-14342)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libX11 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An integer overflow vulnerability leading to a     double-free was found in libX11. This flaw allows a     local privileged attacker to cause an application     compiled with libX11 to crash, or in some cases, result     in arbitrary code execution. The highest threat from     this flaw is to confidentiality, integrity as well as     system availability.(CVE-2020-14363)

  - An integer overflow leading to a heap-buffer overflow     was found in The X Input Method (XIM) client was     implemented in libX11 before version 1.6.10. As per     upstream this is security relevant when setuid programs     call XIM client functions while running with elevated     privileges. No such programs are shipped with Red Hat     Enterprise Linux.(CVE-2020-14344)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the jasker packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in JasPer 2.0.14. There is an     access violation in the function jas_image_readcmpt in     libjasper/base/jas_image.c, leading to a denial of     service.(CVE-2018-19539)

  - An issue was discovered in JasPer 2.0.14. There is a     heap-based buffer overflow of size 1 in the function     jas_icctxtdesc_input in     libjasper/base/jas_icc.c.(CVE-2018-19540)

  - An issue was discovered in JasPer 2.0.14. There is a     NULL pointer dereference in the function jp2_decode in     libjasper/jp2/jp2_dec.c, leading to a denial of     service.(CVE-2018-19542)

  - An issue has been found in JasPer 2.0.14. There is a     memory leak in jas_malloc.c when called from     jpc_unk_getparms in jpc_cs.c.(CVE-2018-19139)

  - An issue was discovered in JasPer 2.0.14. There is a     heap-based buffer over-read of size 8 in the function     jas_image_depalettize in     libjasper/base/jas_image.c.(CVE-2018-19541)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libxml2 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - GNOME project libxml2 v2.9.10 has a global buffer     over-read vulnerability in xmlEncodeEntitiesInternal at     libxml2/entities.c. The issue has been fixed in commit     50f06b3e.(CVE-2020-24977)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the net-snmp packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Net-SNMP through 5.7.3 has Improper Privilege     Management because SNMP WRITE access to the EXTEND MIB     provides the ability to run arbitrary commands as     root.(CVE-2020-15862)

  - Net-SNMP through 5.7.3 allows Escalation of Privileges     because of UNIX symbolic link (symlink)     following.(CVE-2020-15861)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the p11-kit packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in p11-kit 0.21.1 through     0.23.21. Multiple integer overflows have been     discovered in the array allocations in the p11-kit     library and the p11-kit list command, where overflow     checks are missing before calling realloc or     calloc.(CVE-2020-29361)

  - An issue was discovered in p11-kit 0.21.1 through     0.23.21. A heap-based buffer over-read has been     discovered in the RPC protocol used by thep11-kit     server/remote commands and the client library. When the     remote entity supplies a byte array through a     serialized PKCS#11 function call, the receiving entity     may allow the reading of up to 4 bytes of memory past     the heap allocation.(CVE-2020-29362)

  - An issue was discovered in p11-kit 0.23.6 through     0.23.21. A heap-based buffer overflow has been     discovered in the RPC protocol used by p11-kit     server/remote commands and the client library. When the     remote entity supplies a serialized byte array in a     CK_ATTRIBUTE, the receiving entity may not allocate     sufficient length for the buffer to store the     deserialized value.(CVE-2020-29363)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the python-lxml package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A XSS vulnerability was discovered in python-lxml's     clean module. The module's parser didn't properly     imitate browsers, which caused different behaviors     between the sanitizer and the user's page. A remote     attacker could exploit this flaw to run arbitrary     HTML/JS code.(CVE-2020-27783)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The X.509 GeneralName type is a generic type for     representing different types of names. One of those     name types is known as EDIPartyName. OpenSSL provides a     function GENERAL_NAME_cmp which compares different     instances of a GENERAL_NAME to see if they are equal or     not. This function behaves incorrectly when both     GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer     dereference and a crash may occur leading to a possible     denial of service attack. OpenSSL itself uses the     GENERAL_NAME_cmp function for two purposes: 1)     Comparing CRL distribution point names between an     available CRL and a CRL distribution point embedded in     an X509 certificate 2) When verifying that a timestamp     response token signer matches the timestamp authority     name (exposed via the API functions     TS_RESP_verify_response and TS_RESP_verify_token) If an     attacker can control both items being compared then     that attacker could trigger a crash. For example if the     attacker can trick a client or server into checking a     malicious certificate against a malicious CRL then this     may occur. Note that some applications automatically     download CRLs based on a URL embedded in a certificate.
    This checking happens prior to the signatures on the     certificate and CRL being verified. OpenSSL's s_server,     s_client and verify tools have support for the     '-crl_download' option which implements automatic CRL     downloading and this attack has been demonstrated to     work against those tools. Note that an unrelated bug     means that affected versions of OpenSSL cannot parse or     construct correct encodings of EDIPARTYNAME. However it     is possible to construct a malformed EDIPARTYNAME that     OpenSSL's parser will accept and hence trigger this     attack. All OpenSSL 1.1.1 and 1.0.2 versions are     affected by this issue. Other OpenSSL releases are out     of support and have not been checked. Fixed in OpenSSL     1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x     (Affected 1.0.2-1.0.2w).(CVE-2020-1971)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of attribute namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29509)

  - The encoding/xml package in Go versions 1.15 and     earlier does not correctly preserve the semantics of     directives during tokenization round-trips, which     allows an attacker to craft inputs that behave in     conflicting ways during different stages of processing     in affected downstream applications.(CVE-2020-29510)

  - The encoding/xml package in Go (all versions) does not     correctly preserve the semantics of element namespace     prefixes during tokenization round-trips, which allows     an attacker to craft inputs that behave in conflicting     ways during different stages of processing in affected     downstream applications.(CVE-2020-29511)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows     Argument Injection.(CVE-2020-28367)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows Code     Injection.(CVE-2020-28366)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the glib2 package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - GNOME GLib before 2.65.3 has an integer overflow, that     might lead to an out-of-bounds write, in     g_option_group_add_entries. NOTE: the vendor's position     is 'Realistically this is not a security issue. The     standard pattern is for callers to provide a static     list of option entries in a fixed number of calls to     g_option_group_add_entries().' The researcher states     that this pattern is undocumented.(CVE-2020-35457)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x     before 1.18.3 allows unbounded recursion via an     ASN.1-encoded Kerberos message because the     lib/krb5/asn.1/asn1_encode.c support for BER indefinite     lengths lacks a recursion limit.(CVE-2020-28196)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The iconv function in the GNU C Library (aka glibc or     libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an     assertion in the code path and aborts the program,     potentially resulting in a denial of     service.(CVE-2020-29562)

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc     or libc6) before 2.23 on x86 targets has a stack-based     buffer overflow if the input to any of the printf     family of functions is an 80-bit long double with a     non-canonical bit pattern, as seen when passing a     \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by     default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math     functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the     mention of 'Fixed for glibc 2.33' in the 26649     reference.(CVE-2020-29573)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):In do_epoll_ctl and     ep_loop_check_proc of eventpoll.c, there is a possible     use after free due to a logic error. This could lead to     local escalation of privilege with no additional     execution privileges needed.(CVE-2020-0466)In the l2tp     subsystem, there is a possible use after free due to a     race condition. This could lead to local escalation of     privilege with System execution privileges     needed.(CVE-2020-27067)In the nl80211_policy policy of     nl80211.c, there is a possible out of bounds read due     to a missing bounds check. This could lead to local     information disclosure with System execution privileges     needed.(CVE-2020-27068)In audit_free_lsm_field of     auditfilter.c, there is a possible bad kfree due to a     logic error in audit_data_to_entry. This could lead to     local escalation of privilege with no additional     execution privileges needed.(CVE-2020-0444)In various     methods of hid-multitouch.c, there is a possible out of     bounds write due to a missing bounds check. This could     lead to local escalation of privilege with no     additional execution privileges     needed.(CVE-2020-0465)Use-after-free vulnerability in     fs/block_dev.c in the Linux kernel before 5.8 allows     local users to gain privileges or cause a denial of     service by leveraging improper access to a certain     error field.(CVE-2020-15436)The Linux kernel before     version 5.8 is vulnerable to a NULL pointer dereference     in     drivers/tty/serial/8250/8250_core.c:serial8250_isa_init
    _ports() that allows local users to cause a denial of     service by using the p->serial_in pointer which     uninitialized.(CVE-2020-15437)A flaw was found in the     Linux kernels implementation of MIDI, where an attacker     with a local account and the permissions to issue an     ioctl commands to midi devices, could trigger a     use-after-free. A write to this specific memory while     freed and before use could cause the flow of execution     to change and possibly allow for memory corruption or     privilege escalation.(CVE-2020-27786)Array index out of     bounds access when setting extended attributes on     journaling filesystems.(CVE-2020-27815)NULL-ptr deref     in the spk_ttyio_receive_buf2() function in     spk_ttyio.c(CVE-2020-27830)An issue was discovered in
    __split_huge_pmd in mm/huge_memory.c in the Linux     kernel before 5.7.5. The copy-on-write implementation     can grant unintended write access because of a race     condition in a THP mapcount check, aka     CID-c444eb564fb1.(CVE-2020-29368)An issue was     discovered in kmem_cache_alloc_bulk in mm/slub.c in the     Linux kernel before 5.5.11. The slowpath lacks the     required TID increment, aka     CID-fd4d9c7d0c71.(CVE-2020-29370)An issue was     discovered in romfs_dev_read in fs/romfs/storage.c in     the Linux kernel before 5.8.4. Uninitialized memory     leaks to userspace, aka     CID-bcf85fcedfdd.(CVE-2020-29371)A locking     inconsistency issue was discovered in the tty subsystem     of the Linux kernel through 5.9.13.
    drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may     allow a read-after-free attack against TIOCGSID, aka     CID-c8bcd9c5be24.(CVE-2020-29660)A locking issue was     discovered in the tty subsystem of the Linux kernel     through 5.9.13. drivers/tty/tty_jobctrl.c allows a     use-after-free attack against TIOCSPGRP, aka     CID-54ffccbf053b.(CVE-2020-29661)A slab-out-of-bounds     read in fbcon in the Linux kernel before 5.9.7 could be     used by local attackers to read privileged information     or potentially crash the kernel, aka CID-3c4e0dff2095.
    This occurs because KD_FONT_OP_COPY in     drivers/tty/vt/vt.c can be used for manipulations such     as font height.(CVE-2020-28974) An issue was discovered     in the Linux kernel through 5.9.1, as used with Xen     through 4.14.x. Guest OS users can cause a denial of     service (host OS hang) via a high rate of events to     dom0, aka CID-e99502f76271.(CVE-2020-27673)An issue was     discovered in drivers/accessibility/speakup/spk_ttyio.c     in the Linux kernel through 5.9.9. Local attackers on     systems with the speakup driver could cause a local     denial of service attack, aka CID-d41227544427. This     occurs because of an invalid free when the line     discipline is used more than once.(CVE-2020-28941)An     issue was discovered in the Linux kernel through 5.9.1,     as used with Xen through 4.14.x.
    drivers/xen/events/events_base.c allows event-channel     removal during the event-handling loop (a race     condition). This can cause a use-after-free or NULL     pointer dereference, as demonstrated by a dom0 crash     via events for an in-reconfiguration paravirtualized     device, aka CID-073d0552ead5.(CVE-2020-27675)A buffer     over-read (at the framebuffer layer) in the fbcon code     in the Linux kernel before 5.8.15 could be used by     local attackers to read kernel memory, aka     CID-6735b4632def.(CVE-2020-28915)A flaw was found in     the Linux kernel. A use-after-free memory flaw was     found in the perf subsystem allowing a local attacker     with permission to monitor perf events to corrupt     memory and possibly escalate privileges. The highest     threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-14351)A flaw in the way reply     ICMP packets are limited in the Linux kernel     functionality was found that allows to quickly scan     open UDP ports. This flaw allows an off-path remote     user to effectively bypassing source port UDP     randomization. The highest threat from this     vulnerability is to confidentiality and possibly     integrity, because software that relies on UDP source     port randomization are indirectly affected as well.
    Kernel versions before 5.10 may be vulnerable to this     issue.(CVE-2020-25705)race condition in fg_console can     lead to use-after-free in     con_font_op.(CVE-2020-25668)use-after-free read in     sunkbd_reinit in     drivers/input/keyboard/sunkbd.c.(CVE-2020-25669)A flaw     was found in the way RTAS handled memory accesses in     userspace to kernel communication. On a locked down     (usually due to Secure Boot) guest system running on     top of PowerVM or KVM hypervisors (pseries platform) a     root like local user could use this flaw to further     increase their privileges to that of a running     kernel.(CVE-2020-27777)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the xorg-x11-server package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the X.Org Server. An out-of-bounds     access in the XkbSetMap function may lead to a     privilege escalation vulnerability. The highest threat     from this vulnerability is to data confidentiality and     integrity as well as system     availability.(CVE-2020-14360)

  - A flaw was found in xorg-x11-server before 1.20.10. A     heap-buffer overflow in XkbSetDeviceInfo may lead to a     privilege escalation vulnerability. The highest threat     from this vulnerability is to data confidentiality and     integrity as well as system     availability.(CVE-2020-25712)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the hunspell packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Hunspell 1.7.0 has an invalid read operation in     SuggestMgr::leftcommonsubstring in     suggestmgr.cxx.(CVE-2019-16707)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the openldap packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A NULL pointer dereference was found in OpenLDAP server     and was fixed in openldap 2.4.55, during a request for     renaming RDNs. An unauthenticated attacker could     remotely crash the slapd process by sending a specially     crafted request, causing a Denial of     Service.(CVE-2020-25692)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):In create_pinctrl of     core.c, there is a possible out of bounds read due to a     use after free. This could lead to local information     disclosure with no additional execution privileges     needed.(CVE-2020-0427)NULL-ptr deref in the     spk_ttyio_receive_buf2() function in     spk_ttyio.c.(CVE-2020-27830)In do_epoll_ctl and     ep_loop_check_proc of eventpoll.c, there is a possible     use after free due to a logic error. This could lead to     local escalation of privilege with no additional     execution privileges needed.(CVE-2020-0466)In the     nl80211_policy policy of nl80211.c, there is a possible     out of bounds read due to a missing bounds check. This     could lead to local information disclosure with System     execution privileges     needed.(CVE-2020-27068)use-after-free read in     sunkbd_reinit in     drivers/input/keyboard/sunkbd.c.(CVE-2020-25669)A flaw     was found in the Linux kernels implementation of MIDI,     where an attacker with a local account and the     permissions to issue an ioctl commands to midi devices,     could trigger a use-after-free. A write to this     specific memory while freed and before use could cause     the flow of execution to change and possibly allow for     memory corruption or privilege     escalation.(CVE-2020-27786)An issue was discovered in     romfs_dev_read in fs/romfs/storage.c in the Linux     kernel before 5.8.4. Uninitialized memory leaks to     userspace, aka CID-bcf85fcedfdd.(CVE-2020-29371)A     slab-out-of-bounds read in fbcon in the Linux kernel     before 5.9.7 could be used by local attackers to read     privileged information or potentially crash the kernel,     aka CID-3c4e0dff2095. This occurs because     KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for     manipulations such as font height.(CVE-2020-28974)A     locking inconsistency issue was discovered in the tty     subsystem of the Linux kernel through 5.9.13.
    drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may     allow a read-after-free attack against TIOCGSID, aka     CID-c8bcd9c5be24.(CVE-2020-29660)A locking issue was     discovered in the tty subsystem of the Linux kernel     through 5.9.13. drivers/tty/tty_jobctrl.c allows a     use-after-free attack against TIOCSPGRP, aka     CID-54ffccbf053b.(CVE-2020-29661)An issue was     discovered in drivers/accessibility/speakup/spk_ttyio.c     in the Linux kernel through 5.9.9. Local attackers on     systems with the speakup driver could cause a local     denial of service attack, aka CID-d41227544427. This     occurs because of an invalid free when the line     discipline is used more than once.(CVE-2020-28941)A     buffer over-read (at the framebuffer layer) in the     fbcon code in the Linux kernel before 5.8.15 could be     used by local attackers to read kernel memory, aka     CID-6735b4632def.(CVE-2020-28915)A flaw in the way     reply ICMP packets are limited in the Linux kernel     functionality was found that allows to quickly scan     open UDP ports. This flaw allows an off-path remote     user to effectively bypassing source port UDP     randomization. The highest threat from this     vulnerability is to confidentiality and possibly     integrity, because software that relies on UDP source     port randomization are indirectly affected as well.
    Kernel versions before 5.10 may be vulnerable to this     issue.(CVE-2020-25705)race condition in fg_console can     lead to use-after-free in     con_font_op.(CVE-2020-25668)The Linux kernel before     version 5.8 is vulnerable to a NULL pointer dereference     in     drivers/tty/serial/8250/8250_core.c:serial8250_isa_init
    _ports() that allows local users to cause a denial of     service by using the p->serial_in pointer which     uninitialized.(CVE-2020-15437)An issue was discovered     in the Linux kernel through 5.9.1, as used with Xen     through 4.14.x. Guest OS users can cause a denial of     service (host OS hang) via a high rate of events to     dom0, aka CID-e99502f76271.(CVE-2020-27673)An issue was     discovered in __split_huge_pmd in mm/huge_memory.c in     the Linux kernel before 5.7.5. The copy-on-write     implementation can grant unintended write access     because of a race condition in a THP mapcount check,     aka CID-c444eb564fb1.(CVE-2020-29368)An issue was     discovered in the Linux kernel through 5.9.1, as used     with Xen through 4.14.x.
    drivers/xen/events/events_base.c allows event-channel     removal during the event-handling loop (a race     condition). This can cause a use-after-free or NULL     pointer dereference, as demonstrated by a dom0 crash     via events for an in-reconfiguration paravirtualized     device, aka CID-073d0552ead5.(CVE-2020-27675)A flaw was     found in the way RTAS handled memory accesses in     userspace to kernel communication. On a locked down     (usually due to Secure Boot) guest system running on     top of PowerVM or KVM hypervisors (pseries platform) a     root like local user could use this flaw to further     increase their privileges to that of a running     kernel.(CVE-2020-27777)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In Network Security Services (NSS) before 3.46, several     cryptographic primitives had missing length checks. In     cases where the application calling the library did not     perform a sanity check on the inputs it could result in     a crash due to a buffer overflow.(CVE-2019-17006)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the open-iscsi package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in uIP 1.0, as used in Contiki     3.0 and other products. When the Urgent flag is set in     a TCP packet, and the stack is configured to ignore the     urgent data, the stack attempts to use the value of the     Urgent pointer bytes to separate the Urgent data from     the normal data, by calculating the offset at which the     normal data should be present in the global buffer.
    However, the length of this offset is not checked     therefore, for large values of the Urgent pointer     bytes, the data pointer can point to memory that is way     beyond the data buffer in uip_process in     uip.c.(CVE-2020-17437)

  - An issue was discovered in Contiki through 3.0. An     Integer Overflow exists in the uIP TCP/IP Stack     component when parsing TCP MSS options of IPv4 network     packets in uip_process in     net/ipv4/uip.c.(CVE-2020-13988)

  - An issue was discovered in Contiki through 3.0. An     Out-of-Bounds Read vulnerability exists in the uIP     TCP/IP Stack component when calculating the checksums     for IP packets in upper_layer_chksum in     net/ipv4/uip.c.(CVE-2020-13987)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the kata-containers package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An improper file permissions vulnerability affects Kata     Containers prior to 1.11.5. When using a Kubernetes     hostPath volume and mounting either a file or directory     into a container as readonly, the file/directory is     mounted as readOnly inside the container, but is still     writable inside the guest. For a container breakout     situation, a malicious guest can potentially modify or     delete files/directories expected to be     read-only.(CVE-2020-28914)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A Null Pointer Dereference vulnerability exists in the     Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.34, in     debug_get_real_type, as demonstrated in objdump, that     can cause a denial of service via a crafted     file.(CVE-2020-16598)

  - A use after free issue exists in the Binary File     Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new,     that can cause a denial of service via a crafted     file.(CVE-2020-16592)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 ->     9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also     affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1     of the BIND 9 Supported Preview Edition, An attacker     who has been granted privileges to change a specific     subset of the zone's content could abuse these     unintended additional privileges to update other     contents of the zone.(CVE-2020-8624)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in samba's DNS server. An     authenticated user could use this flaw to the RPC     server to crash. This RPC server, which also serves     protocols other than dnsserver, will be restarted after     a short delay, but it is easy for an authenticated non     administrative attacker to crash it again as soon as it     returns. The Samba DNS server itself will continue to     operate, but many RPC services will     not.(CVE-2020-14383)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - curl 7.21.0 to and including 7.73.0 is vulnerable to     uncontrolled recursion due to a stack overflow issue in     FTP wildcard match parsing.(CVE-2020-8285)

  - curl 7.41.0 through 7.73.0 is vulnerable to an improper     check for certificate revocation due to insufficient     verification of the OCSP response.(CVE-2020-8286)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - NLnet Labs Unbound, up to and including version 1.12.0,     and NLnet Labs NSD, up to and including version 4.3.3,     contain a local vulnerability that would allow for a     local symlink attack. When writing the PID file,     Unbound and NSD create the file if it is not there, or     open an existing file for writing. In case the file was     already present, they would follow symlinks if the file     happened to be a symlink instead of a regular file. An     additional chown of the file would then take place     after it was written, making the user Unbound/NSD is     supposed to run as the new owner of the file. If an     attacker has local access to the user Unbound/NSD runs     as, she could create a symlink in place of the PID file     pointing to a file that she would like to erase. If     then Unbound/NSD is killed and the PID file is not     cleared, upon restarting with root privileges,     Unbound/NSD will rewrite any file pointed at by the     symlink. This is a local vulnerability that could     create a Denial of Service of the system Unbound/NSD is     running on. It requires an attacker having access to     the limited permission user Unbound/NSD runs as and     point through the symlink to a critical file on the     system.(CVE-2020-28935)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Severity
144831	EulerOS Virtualization 3.0.2.6 : kernel (EulerOS-SA-2021-1056)	Critical
144829	EulerOS Virtualization 3.0.2.6 : qemu (EulerOS-SA-2021-1057)	High
144742	EulerOS Virtualization for ARM 64 3.0.2.0 : trousers (EulerOS-SA-2021-1051)	High
144741	EulerOS Virtualization for ARM 64 3.0.2.0 : xorg-x11-server (EulerOS-SA-2021-1048)	Medium
144739	EulerOS Virtualization for ARM 64 3.0.2.0 : samba (EulerOS-SA-2021-1050)	High
144734	EulerOS Virtualization for ARM 64 3.0.2.0 : augeas (EulerOS-SA-2021-1042)	High
144731	EulerOS Virtualization for ARM 64 3.0.2.0 : kernel (EulerOS-SA-2021-1039)	High
144728	EulerOS Virtualization for ARM 64 3.0.2.0 : libvirt (EulerOS-SA-2021-1045)	High
144727	EulerOS Virtualization for ARM 64 3.0.2.0 : spdk (EulerOS-SA-2021-1043)	High
144726	EulerOS Virtualization for ARM 64 3.0.2.0 : qemu-kvm (EulerOS-SA-2021-1046)	Medium
144724	EulerOS Virtualization for ARM 64 3.0.2.0 : perl-DBD-MySQL (EulerOS-SA-2021-1053)	Medium
144722	EulerOS Virtualization for ARM 64 3.0.2.0 : ghostscript (EulerOS-SA-2021-1041)	Medium
144721	EulerOS Virtualization for ARM 64 3.0.2.0 : mariadb (EulerOS-SA-2021-1055)	Medium
144720	EulerOS Virtualization for ARM 64 3.0.2.0 : cifs-utils (EulerOS-SA-2021-1054)	Medium
144719	EulerOS Virtualization for ARM 64 3.0.2.0 : libX11 (EulerOS-SA-2021-1049)	Medium
144718	EulerOS Virtualization for ARM 64 3.0.2.0 : jasker (EulerOS-SA-2021-1044)	Medium
144716	EulerOS Virtualization for ARM 64 3.0.2.0 : libxml2 (EulerOS-SA-2021-1047)	Medium
144715	EulerOS Virtualization for ARM 64 3.0.2.0 : net-snmp (EulerOS-SA-2021-1040)	High
144703	EulerOS 2.0 SP9 : p11-kit (EulerOS-SA-2021-1034)	Medium
144702	EulerOS 2.0 SP9 : python-lxml (EulerOS-SA-2021-1035)	Medium
144700	EulerOS 2.0 SP9 : openssl (EulerOS-SA-2021-1033)	Medium
144699	EulerOS 2.0 SP9 : golang (EulerOS-SA-2021-1025)	Medium
144698	EulerOS : glib2 (EulerOS-SA-2021-1004)	Medium
144697	EulerOS : krb5 (EulerOS-SA-2021-1010)	Medium
144695	EulerOS 2.0 SP9 : glibc (EulerOS-SA-2021-1024)	Medium
144693	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2021-1028)	High
144692	EulerOS 2.0 SP9 : xorg-x11-server (EulerOS-SA-2021-1038)	Medium
144690	EulerOS 2.0 SP9 : hunspell (EulerOS-SA-2021-1026)	Medium
144689	EulerOS 2.0 SP9 : openldap (EulerOS-SA-2021-1032)	Medium
144688	EulerOS 2.0 SP9 : krb5 (EulerOS-SA-2021-1029)	Medium
144687	EulerOS : kernel (EulerOS-SA-2021-1009)	High
144686	EulerOS : golang (EulerOS-SA-2021-1006)	Medium
144685	EulerOS : glibc (EulerOS-SA-2021-1005)	Medium
144684	EulerOS 2.0 SP9 : nss (EulerOS-SA-2021-1030)	Critical
144683	EulerOS 2.0 SP9 : open-iscsi (EulerOS-SA-2021-1031)	Medium
144682	EulerOS : nss (EulerOS-SA-2021-1011)	Critical
144680	EulerOS 2.0 SP9 : kata-containers (EulerOS-SA-2021-1027)	Low
144678	EulerOS 2.0 SP9 : binutils (EulerOS-SA-2021-1021)	Medium
144677	EulerOS 2.0 SP9 : bind (EulerOS-SA-2021-1020)	Medium
144676	EulerOS : python-lxml (EulerOS-SA-2021-1016)	Medium
144675	EulerOS : p11-kit (EulerOS-SA-2021-1015)	Medium
144674	EulerOS : samba (EulerOS-SA-2021-1017)	Medium
144671	EulerOS 2.0 SP9 : samba (EulerOS-SA-2021-1036)	Medium
144670	EulerOS : curl (EulerOS-SA-2021-1003)	Medium
144668	EulerOS : binutils (EulerOS-SA-2021-1002)	Medium
144667	EulerOS 2.0 SP9 : curl (EulerOS-SA-2021-1022)	Medium
144665	EulerOS : openssl (EulerOS-SA-2021-1014)	Medium
144664	EulerOS : hunspell (EulerOS-SA-2021-1007)	Medium
144663	EulerOS : openldap (EulerOS-SA-2021-1013)	Medium
144662	EulerOS : unbound (EulerOS-SA-2021-1018)	Low

Huawei Local Security Checks Family for Nessus