According to the version of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - fileio.c in Vim prior to 8.0.1263 sets the group     ownership of a .swp file to the editor's primary group     (which may be different from the group ownership of the     original file), which allows local users to obtain     sensitive information by leveraging an applicable group     membership, as demonstrated by /etc/shadow owned by     root:shadow mode 0640, but /etc/.shadow.swp owned by     root:users mode 0640, a different vulnerability than     CVE-2017-1000382.(CVE-2017-17087)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the xorg-x11-server packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - xorg-x11-server before 1.19.5 was vulnerable to integer     overflow in ProcDbeGetVisualInfo function allowing     malicious X client to cause X server to crash or     possibly execute arbitrary code.(CVE-2017-12177)

  - xorg-x11-server before 1.19.5 had wrong extra length     check in ProcXIChangeHierarchy function allowing     malicious X client to cause X server to crash or     possibly execute arbitrary code.(CVE-2017-12178)

  - xorg-x11-server before 1.19.5 was vulnerable to integer     overflow in (S)ProcXIBarrierReleasePointer functions     allowing malicious X client to cause X server to crash     or possibly execute arbitrary code.(CVE-2017-12179)

  - xorg-x11-server before 1.19.5 was missing length     validation in XFree86 VidModeExtension allowing     malicious X client to cause X server to crash or     possibly execute arbitrary code.(CVE-2017-12180)

  - xorg-x11-server before 1.19.5 was missing length     validation in XFree86 DGA extension allowing malicious     X client to cause X server to crash or possibly execute     arbitrary code.(CVE-2017-12181)

  - xorg-x11-server before 1.19.5 was missing length     validation in XFree86 DRI extension allowing malicious     X client to cause X server to crash or possibly execute     arbitrary code.(CVE-2017-12182)

  - xorg-x11-server before 1.19.5 was missing length     validation in XFIXES extension allowing malicious X     client to cause X server to crash or possibly execute     arbitrary code.(CVE-2017-12183)

  - xorg-x11-server before 1.19.5 was missing length     validation in XINERAMA extension allowing malicious X     client to cause X server to crash or possibly execute     arbitrary code.(CVE-2017-12184)

  - xorg-x11-server before 1.19.5 was missing length     validation in MIT-SCREEN-SAVER extension allowing     malicious X client to cause X server to crash or     possibly execute arbitrary code.(CVE-2017-12185)

  - xorg-x11-server before 1.19.5 was missing length     validation in X-Resource extension allowing malicious X     client to cause X server to crash or possibly execute     arbitrary code.(CVE-2017-12186)

  - xorg-x11-server before 1.19.5 was missing length     validation in RENDER extension allowing malicious X     client to cause X server to crash or possibly execute     arbitrary code.(CVE-2017-12187)

  - In X.Org Server (aka xserver and xorg-server) before     1.19.4, an attacker authenticated to an X server with     the X shared memory extension enabled can cause aborts     of the X server or replace shared memory segments of     other X clients in the same session.(CVE-2017-13721)

  - It was found that xorg-x11-server before 1.19.0     including uses memcmp() to check the received MIT     cookie against a series of valid cookies. If the cookie     is correct, it is allowed to attach to the Xorg     session. Since most memcmp() implementations return     after an invalid byte is seen, this causes a time     difference between a valid and invalid byte, which     could allow an efficient brute force     attack.(CVE-2017-2624)

  - A flaw was found in xorg-x11-server before 1.20.3. An     incorrect permission check for -modulepath and -logfile     options when starting Xorg. X server allows     unprivileged users with the ability to log in to the     system via physical console to escalate their     privileges and run arbitrary code under root     privileges.(CVE-2018-14665)

  - In the X.Org X server before 2017-06-19, a user     authenticated to an X Session could crash or execute     code in the context of the X Server by exploiting a     stack overflow in the endianness conversion of X     Events.(CVE-2017-10971)

  - Uninitialized data in endianness conversion in the     XEvent handling of the X.Org X Server before 2017-06-19     allowed authenticated malicious users to access     potentially privileged data from the X     server.(CVE-2017-10972)

  - xorg-x11-server before 1.19.5 was missing extra length     validation in ProcEstablishConnection function allowing     malicious X client to cause X server to crash or     possibly execute arbitrary code.(CVE-2017-12176)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ncurses packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - There is a heap-based buffer over-read in the
    _nc_find_entry function in tinfo/comp_hash.c in the     terminfo library in ncurses before     6.1-20191012.(CVE-2019-17594)

  - There is a heap-based buffer over-read in the fmt_entry     function in tinfo/comp_hash.c in the terminfo library     in ncurses before 6.1-20191012.(CVE-2019-17595)

  - In ncurses 6.0, there is a stack-based buffer overflow     in the fmt_entry function. A crafted input will lead to     a remote arbitrary code execution     attack.(CVE-2017-10684)

  - In ncurses 6.0, there is a format string vulnerability     in the fmt_entry function. A crafted input will lead to     a remote arbitrary code execution     attack.(CVE-2017-10685)

  - In ncurses 6.0, there is an attempted     0xffffffffffffffff access in the append_acs function of     tinfo/parse_entry.c. It could lead to a remote denial     of service attack if the terminfo library code is used     to process untrusted terminfo data.(CVE-2017-11112)

  - In ncurses 6.0, there is a NULL Pointer Dereference in     the _nc_parse_entry function of tinfo/parse_entry.c. It     could lead to a remote denial of service attack if the     terminfo library code is used to process untrusted     terminfo data.(CVE-2017-11113)

  - There is an infinite loop in the next_char function in     comp_scan.c in ncurses 6.0, related to libtic. A     crafted input will lead to a remote denial of service     attack.(CVE-2017-13728)

  - There is an illegal address access in the _nc_save_str     function in alloc_entry.c in ncurses 6.0. It will lead     to a remote denial of service attack.(CVE-2017-13729)

  - There is an illegal address access in the function
    _nc_read_entry_source() in progs/tic.c in ncurses 6.0     that might lead to a remote denial of service     attack.(CVE-2017-13730)

  - There is an illegal address access in the function     postprocess_termcap() in parse_entry.c in ncurses 6.0     that will lead to a remote denial of service     attack.(CVE-2017-13731)

  - There is an illegal address access in the function     dump_uses() in progs/dump_entry.c in ncurses 6.0 that     might lead to a remote denial of service     attack.(CVE-2017-13732)

  - There is an illegal address access in the fmt_entry     function in progs/dump_entry.c in ncurses 6.0 that     might lead to a remote denial of service     attack.(CVE-2017-13733)

  - There is an illegal address access in the
    _nc_safe_strcat function in strings.c in ncurses 6.0     that will lead to a remote denial of service     attack.(CVE-2017-13734)

  - In ncurses 6.1, there is a NULL pointer dereference at     function _nc_parse_entry in parse_entry.c that will     lead to a denial of service attack. The product     proceeds to the dereference code path even after a     'dubious character `*' in name or alias field'     detection.(CVE-2018-19211)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The Dumper method in Data::Dumper before 2.154, as used     in Perl 5.20.1 and earlier, allows context-dependent     attackers to cause a denial of service (stack     consumption and crash) via an Array-Reference with many     nested Array-References, which triggers a large number     of recursive calls to the DD_dump     function.(CVE-2014-4330)

  - Integer underflow in regcomp.c in Perl before 5.20, as     used in Apple OS X before 10.10.5 and other products,     allows context-dependent attackers to execute arbitrary     code or cause a denial of service (application crash)     via a long digit string associated with an invalid     backreference within a regular     expression.(CVE-2013-7422)

  - (1) cpan/Archive-Tar/bin/ptar, (2)     cpan/Archive-Tar/bin/ptardiff, (3)     cpan/Archive-Tar/bin/ptargrep, (4)     cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6)     cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess,     (8) cpan/Encode/bin/piconv, (9)     cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump,     (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12)     cpan/IO-Compress/bin/zipdetails, (13)     cpan/JSON-PP/bin/json_pp, (14)     cpan/Test-Harness/bin/prove, (15)     dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16)     dist/Module-CoreList/corelist, (17)     ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19)     utils/h2ph.PL, (20) utils/h2xs.PL, (21)     utils/libnetcfg.PL, (22) utils/perlbug.PL, (23)     utils/perldoc.PL, (24) utils/perlivp.PL, and (25)     utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24     before 5.24.1-RC2 do not properly remove . (period)     characters from the end of the includes directory     array, which might allow local users to gain privileges     via a Trojan horse module under the current working     directory.(CVE-2016-1238)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the rsyslog packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in Rsyslog v8.1908.0.
    contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a     heap overflow in the parser for AIX log messages. The     parser tries to locate a log message delimiter (in this     case, a space or a colon) but fails to account for     strings that do not satisfy this constraint. If the     string does not match, then the variable lenMsg will     reach the value zero and will skip the sanity check     that detects invalid log messages. The message will     then be considered valid, and the parser will eat up     the nonexistent colon delimiter. In doing so, it will     decrement lenMsg, a signed integer, whose value was     zero and now becomes minus one. The following step in     the parser is to shift left the contents of the     message. To do this, it will call memmove with the     right pointers to the target and destination strings,     but the lenMsg will now be interpreted as a huge value,     causing a heap overflow.(CVE-2019-17041)

  - An issue was discovered in Rsyslog v8.1908.0.
    contrib/pmcisconames/pmcisconames.c has a heap overflow     in the parser for Cisco log messages. The parser tries     to locate a log message delimiter (in this case, a     space or a colon), but fails to account for strings     that do not satisfy this constraint. If the string does     not match, then the variable lenMsg will reach the     value zero and will skip the sanity check that detects     invalid log messages. The message will then be     considered valid, and the parser will eat up the     nonexistent colon delimiter. In doing so, it will     decrement lenMsg, a signed integer, whose value was     zero and now becomes minus one. The following step in     the parser is to shift left the contents of the     message. To do this, it will call memmove with the     right pointers to the target and destination strings,     but the lenMsg will now be interpreted as a huge value,     causing a heap overflow.(CVE-2019-17042)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the coreutils package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In GNU Coreutils through 8.29, chown-core.c in chown     and chgrp does not prevent replacement of a plain file     with a symlink during use of the POSIX '-R -L' options,     which allows local users to modify the ownership of     arbitrary files by leveraging a race     condition.(CVE-2017-18018)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libgxps package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - There is a NULL pointer dereference in the     caseless_hash function in gxps-archive.c in libgxps     0.2.5. A crafted input will lead to a remote denial of     service attack.(CVE-2017-11590)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the perl-Archive-Tar package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In Perl through 5.26.2, the Archive::Tar module allows     remote attackers to bypass a directory-traversal     protection mechanism, and overwrite arbitrary files,     via an archive file containing a symlink and a regular     file with the same name.(CVE-2018-12015)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In Sudo before 1.8.28, an attacker with access to a     Runas ALL sudoer account can bypass certain policy     blacklists and session PAM modules, and can cause     incorrect logging, by invoking sudo with a crafted user     ID. For example, this allows bypass of !root     configuration, and USER= logging, for a 'sudo -u     \#$((0xffffffff))' command.(CVE-2019-14287)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the wavpack package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The read_code function in read_words.c in Wavpack     before 5.1.0 allows remote attackers to cause a denial     of service (out-of-bounds read) via a crafted WV     file.(CVE-2016-10169)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the foomatic packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Incomplete blacklist vulnerability in util.c in     foomatic-rip in cups-filters 1.0.42 before 1.2.0 and in     foomatic-filters in Foomatic 4.0.x allows remote     attackers to execute arbitrary commands via `     (backtick) characters in a print job.(CVE-2015-8327)

  - Incomplete blacklist vulnerability in util.c in     foomatic-rip in cups-filters 1.0.42 before 1.4.0 and in     foomatic-filters in Foomatic 4.0.x allows remote     attackers to execute arbitrary commands via a     (semicolon) character in a print job, a different     vulnerability than CVE-2015-8327.(CVE-2015-8560)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the bzip2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Use-after-free vulnerability in bzip2recover in bzip2     1.0.6 allows remote attackers to cause a denial of     service (crash) via a crafted bzip2 file, related to     block ends set to before the start of the     block.(CVE-2016-3189)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The default configuration for cURL and libcurl before     7.42.1 sends custom HTTP headers to both the proxy and     destination server, which might allow remote proxy     servers to obtain sensitive information by reading the     header contents.(CVE-2015-3153)

  - curl before version 7.51.0 uses outdated IDNA 2003     standard to handle International Domain Names and this     may lead users to potentially and unknowingly issue     network transfer requests to the wrong     host.(CVE-2016-8625)

  - Heap buffer overflow in the TFTP protocol handler in     cURL 7.19.4 to 7.65.3.(CVE-2019-5482)

  - Curl versions 7.14.1 through 7.61.1 are vulnerable to a     heap-based buffer over-read in the tool_msgs.c:voutf()     function that may result in information exposure and     denial of service.(CVE-2018-16842)

  - The ConnectionExists function in lib/url.c in libcurl     before 7.47.0 does not properly re-use     NTLM-authenticated proxy connections, which might allow     remote attackers to authenticate as other users via a     request, a similar issue to     CVE-2014-0015.(CVE-2016-0755)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glib2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In GNOME GLib 2.56.1,     g_markup_parse_context_end_parse() in gmarkup.c has a     NULL pointer dereference.(CVE-2018-16428)

  - GNOME GLib 2.56.1 has an out-of-bounds read     vulnerability in g_markup_parse_context_parse() in     gmarkup.c, related to utf8_str().(CVE-2018-16429)

  - gio/gsocketclient.c in GNOME GLib 2.59.2 does not     ensure that a parent GTask remains alive during the     execution of a connection-attempting enumeration, which     allows remote attackers to cause a denial of service     (g_socket_client_connected_callback mishandling and     application crash) via a crafted web site, as     demonstrated by GNOME Web (aka     Epiphany).(CVE-2019-9633)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the quagga package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Open Shortest Path First (OSPF) protocol     implementations may improperly determine Link State     Advertisement (LSA) recency for LSAs with     MaxSequenceNumber. According to RFC 2328 section 13.1,     for two instances of the same LSA, recency is     determined by first comparing sequence numbers, then     checksums, and finally MaxAge. In a case where the     sequence numbers are the same, the LSA with the larger     checksum is considered more recent, and will not be     flushed from the Link State Database (LSDB). Since the     RFC does not explicitly state that the values of links     carried by a LSA must be the same when prematurely     aging a self-originating LSA with MaxSequenceNumber, it     is possible in vulnerable OSPF implementations for an     attacker to craft a LSA with MaxSequenceNumber and     invalid links that will result in a larger checksum and     thus a 'newer' LSA that will not be flushed from the     LSDB. Propagation of the crafted LSA can result in the     erasure or alteration of the routing tables of routers     within the routing domain, creating a denial of service     condition or the re-routing of traffic on the network.
    CVE-2017-3224 has been reserved for Quagga and     downstream implementations (SUSE, openSUSE, and Red Hat     packages).(CVE-2017-3224)

  - The bgp_dump_routes_func function in bgpd/bgp_dump.c in     Quagga does not perform size checks when dumping data,     which might allow remote attackers to cause a denial of     service (assertion failure and daemon crash) via a     large BGP packet.(CVE-2016-4049)

  - The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in     the VPNv4 NLRI parser in bgpd in Quagga before     1.0.20160309, when a certain VPNv4 configuration is     used, relies on a Labeled-VPN SAFI routes-data length     field during a data copy, which allows remote attackers     to execute arbitrary code or cause a denial of service     (stack-based buffer overflow) via a crafted     packet.(CVE-2016-2342)

  - The Quagga BGP daemon (bgpd) prior to version 1.2.3 can     overrun internal BGP code-to-string conversion tables     used for debug by 1 pointer value, based on     input.(CVE-2018-5380)

  - The Quagga BGP daemon (bgpd) prior to version 1.2.3 has     a bug in its parsing of 'Capabilities' in BGP OPEN     messages, in the bgp_packet.c:bgp_capability_msg_parse     function. The parser can enter an infinite loop on     invalid capabilities if a Multi-Protocol capability     does not have a recognized AFI/SAFI, causing a denial     of service.(CVE-2018-5381)

  - It was discovered that the zebra daemon in Quagga     before 1.0.20161017 suffered from a stack-based buffer     overflow when processing IPv6 Neighbor Discovery     messages. The root cause was relying on BUFSIZ to be     compatible with a message size however, BUFSIZ is     system-dependent.(CVE-2016-1245)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libjpeg-turbo packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The cjpeg utility in libjpeg allows remote attackers to     cause a denial of service (NULL pointer dereference and     application crash) or execute arbitrary code via a     crafted file.(CVE-2016-3616)

  - get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90     and MozJPEG through 3.3.1 allows attackers to cause a     denial of service (heap-based buffer over-read and     application crash) via a crafted 8-bit BMP in which one     or more of the color indices is out of range for the     number of palette entries.(CVE-2018-14498)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the gpgme package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - GnuPG Made Easy (GPGME) is a library designed to make     access to GnuPG easier for applications. It provides a     high-level crypto API for encryption, decryption,     signing, signature verification and key management.

  - Security fix(es):

  - Multiple heap-based buffer overflows in the     status_handler function in (1) engine-gpgsm.c and (2)     engine-uiserver.c in GPGME before 1.5.1 allow remote     attackers to cause a denial of service (crash) and     possibly execute arbitrary code via vectors related to     'different line lengths in a specific     order.'(CVE-2014-3564)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the dom4j package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - dom4j version prior to version 2.1.1 contains a CWE-91:
    XML Injection vulnerability in Class: Element. Methods:
    addElement, addAttribute that can result in an attacker     tampering with XML documents through XML injection.
    This attack appear to be exploitable via an attacker     specifying attributes or elements in the XML document.
    This vulnerability appears to have been fixed in 2.1.1     or later.(CVE-2018-1000632)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the polkit packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in polkit before version 0.116. The     implementation of the     polkit_backend_interactive_authority_check_authorizatio     n function in polkitd allows to test for authentication     and trigger authentication of unrelated processes owned     by other users. This may result in a local DoS and     information disclosure.(CVE-2018-1116)

  - Integer overflow in the authentication_agent_new_cookie     function in PolicyKit (aka polkit) before 0.113 allows     local users to gain privileges by creating a large     number of connections, which triggers the issuance of a     duplicate cookie value.(CVE-2015-4625)

  - The authentication_agent_new function in     polkitbackend/polkitbackendinteractiveauthority.c in     PolicyKit (aka polkit) before 0.113 allows local users     to cause a denial of service (NULL pointer dereference     and polkitd daemon crash) by calling     RegisterAuthenticationAgent with an invalid object     path.(CVE-2015-3218)

  - The polkit_backend_action_pool_init function in     polkitbackend/polkitbackendactionpool.c in PolicyKit     (aka polkit) before 0.113 might allow local users to     gain privileges via duplicate action IDs in action     descriptions.(CVE-2015-3255)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in Oniguruma 6.2.0, as used in     Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP     through 7.1.5. A stack out-of-bounds read occurs in     match_at() during regular expression searching. A     logical error involving order of validation and access     in match_at() could result in an out-of-bounds read     from a stack buffer.(CVE-2017-9224)

  - An issue was discovered in Oniguruma 6.2.0, as used in     Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP     through 7.1.5. A heap out-of-bounds write or read     occurs in next_state_val() during regular expression     compilation. Octal numbers larger than 0xff are not     handled correctly in fetch_token() and     fetch_token_in_cc(). A malformed regular expression     containing an octal number in the form of '\700' would     produce an invalid code point value larger than 0xff in     next_state_val(), resulting in an out-of-bounds write     memory corruption.(CVE-2017-9226)

  - An issue was discovered in Oniguruma 6.2.0, as used in     Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP     through 7.1.5. A stack out-of-bounds read occurs in     mbc_enc_len() during regular expression searching.
    Invalid handling of reg->dmin in forward_search_range()     could result in an invalid pointer dereference, as an     out-of-bounds read from a stack buffer.(CVE-2017-9227)

  - An issue was discovered in Oniguruma 6.2.0, as used in     Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP     through 7.1.5. A heap out-of-bounds write occurs in     bitset_set_range() during regular expression     compilation due to an uninitialized variable from an     incorrect state transition. An incorrect state     transition in parse_char_class() could create an     execution path that leaves a critical local variable     uninitialized until it's used as an index, resulting in     an out-of-bounds write memory     corruption.(CVE-2017-9228)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Possible CRLF injection allowing HTTP response     splitting attacks for sites which use mod_userdir. This     issue was mitigated by changes made in 2.4.25 and     2.2.32 which prohibit CR or LF injection into the     'Location' or other outbound header key or value. Fixed     in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23).
    Fixed in Apache HTTP Server 2.2.32 (Affected     2.2.0-2.2.31).(CVE-2016-4975)

  - A specially crafted request could have crashed the     Apache HTTP Server prior to version 2.4.30, due to an     out of bound access after a size limit is reached by     reading the HTTP header. This vulnerability is     considered very hard if not impossible to trigger in     non-debug mode (both log and build level), so it is     classified as low risk for common server     usage.(CVE-2018-1301)

  - In Apache httpd 2.4.0 to 2.4.29, when mod_session is     configured to forward its session data to CGI     applications (SessionEnv on, not the default), a remote     user may influence their content by using a 'Session'     header. This comes from the 'HTTP_SESSION' variable     name used by mod_session to forward its data to CGIs,     since the prefix 'HTTP_' is also used by the Apache     HTTP Server to pass HTTP header fields, per CGI     specifications.(CVE-2018-1283)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the lcms2 package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The Type_MLU_Read function in cmstypes.c in Little CMS     (aka lcms2) allows remote attackers to obtain sensitive     information or cause a denial of service via an image     with a crafted ICC profile, which triggers an     out-of-bounds heap read.(CVE-2016-10165)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the policycoreutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Context relabeling of filesystems is vulnerable to     symbolic link attack, allowing a local, unprivileged     malicious entity to change the SELinux context of an     arbitrary file to a context with few restrictions. This     only happens when the relabeling process is done,     usually when taking SELinux state from disabled to     enable (permissive or enforcing). The issue was found     in policycoreutils 2.5-11.(CVE-2018-1063)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ppp package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Buffer overflow in the rc_mksid function in     plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6     and earlier, when the PID for pppd is greater than     65535, allows remote attackers to cause a denial of     service (crash) via a start accounting message to the     RADIUS server.(CVE-2015-3310)

  - Integer overflow in the getword function in options.c     in pppd in Paul's PPP Package (ppp) before 2.4.7 allows     attackers to 'access privileged options' via a long     word in an options file, which triggers a heap-based     buffer overflow that '[corrupts] security-relevant     variables.'(CVE-2014-3158)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libsamplerate package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In libsamplerate before 0.1.9, a buffer over-read     occurs in the calc_output_single function in src_sinc.c     via a crafted audio file.(CVE-2017-7697)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the jakarta-commons-httpclient package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - http/conn/ssl/SSLConnectionSocketFactory.java in Apache     HttpComponents HttpClient before 4.3.6 ignores the     http.socket.timeout configuration setting during an SSL     handshake, which allows remote attackers to cause a     denial of service (HTTPS call hang) via unspecified     vectors.(CVE-2015-5262)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the jansson package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Jansson 2.7 and earlier allows context-dependent     attackers to cause a denial of service (deep recursion,     stack consumption, and crash) via crafted JSON     data.(CVE-2016-4425)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libplist package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - libplist allows attackers to cause a denial of service     (large memory allocation and crash) via vectors     involving an offset size of zero.(CVE-2017-5835)

  - The main function in plistutil.c in libimobiledevice     libplist through 1.12 allows attackers to obtain     sensitive information from process memory or cause a     denial of service (buffer over-read) via Apple Property     List data that is too short.(CVE-2017-5545)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the openslp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Buffer overflow in the SLPFoldWhiteSpace function in     common/slp_compare.c in OpenSLP 2.0 allows remote     attackers to have unspecified impact via a crafted     string.(CVE-2016-7567)

  - The _xrealloc function in xlsp_xmalloc.c in OpenSLP     2.0.0 allows remote attackers to cause a denial of     service (NULL pointer dereference and crash) via a     large number of crafted packets, which triggers a     memory allocation failure.(CVE-2016-4912)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the gnupg2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - GnuPG 2.2.4 and 2.2.5 does not enforce a configuration     in which key certification requires an offline master     Certify key, which results in apparently valid     certifications that occurred only with access to a     signing subkey.(CVE-2018-9234)

  - The do_uncompress function in g10/compress.c in GnuPG     1.x before 1.4.17 and 2.x before 2.0.24 allows     context-dependent attackers to cause a denial of     service (infinite loop) via malformed compressed     packets, as demonstrated by an a3 01 5b ff byte     sequence.(CVE-2014-4617)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libidn package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - idn in libidn before 1.33 might allow remote attackers     to obtain sensitive memory information by reading a     zero byte as input, which triggers an out-of-bounds     read, a different vulnerability than     CVE-2015-8948.(CVE-2016-6262)

  - idn in GNU libidn before 1.33 might allow remote     attackers to obtain sensitive memory information by     reading a zero byte as input, which triggers an     out-of-bounds read.(CVE-2015-8948)

  - The stringprep_utf8_nfkc_normalize function in     lib/nfkc.c in libidn before 1.33 allows     context-dependent attackers to cause a denial of     service (out-of-bounds read and crash) via crafted     UTF-8 data.(CVE-2016-6263)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the memcached package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The try_read_command function in memcached.c in     memcached before 1.4.39 allows remote attackers to     cause a denial of service (segmentation fault) via a     request to add/set a key, which makes a comparison     between signed and unsigned int and triggers a     heap-based buffer over-read. NOTE: this vulnerability     exists because of an incomplete fix for     CVE-2016-8705.(CVE-2017-9951)

  - Memcached version 1.5.5 contains an Insufficient     Control of Network Message Volume (Network     Amplification, CWE-406) vulnerability in the UDP     support of the memcached server that can result in     denial of service via network flood (traffic     amplification of 1:50,000 has been reported by reliable     sources). This attack appear to be exploitable via     network connectivity to port 11211 UDP. This     vulnerability appears to have been fixed in 1.5.6 due     to the disabling of the UDP protocol by     default.(CVE-2018-1000115)

  - memcached version prior to 1.4.37 contains an Integer     Overflow vulnerability in items.c:item_free() that can     result in data corruption and deadlocks due to items     existing in hash table being reused from free list.
    This attack appear to be exploitable via network     connectivity to the memcached service. This     vulnerability appears to have been fixed in 1.4.37 and     later.(CVE-2018-1000127)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the icu packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Stack-based buffer overflow in the Locale class in     common/locid.cpp in International Components for     Unicode (ICU) through 57.1 for C/C++ allows remote     attackers to cause a denial of service (application     crash) or possibly have unspecified other impact via a     long locale string.(CVE-2016-7415)

  - Integer overflow in international date handling in     International Components for Unicode (ICU) for C/C++     before 60.1, as used in V8 in Google Chrome prior to     63.0.3239.84 and other products, allowed a remote     attacker to perform an out of bounds memory read via a     crafted HTML page.(CVE-2017-15422)

  - The Regular Expressions package in International     Components for Unicode (ICU) 52 before SVN revision     292944, as used in Google Chrome before 40.0.2214.91,     allows remote attackers to cause a denial of service     (memory corruption) or possibly have unspecified other     impact via vectors related to a look-behind     expression.(CVE-2014-7923)

  - The Regular Expressions package in International     Components for Unicode (ICU) 52 before SVN revision     292944, as used in Google Chrome before 40.0.2214.91,     allows remote attackers to cause a denial of service     (memory corruption) or possibly have unspecified other     impact via vectors related to a zero-length     quantifier.(CVE-2014-7926)

  - The collator implementation in i18n/ucol.cpp in     International Components for Unicode (ICU) 52 through     SVN revision 293126, as used in Google Chrome before     40.0.2214.91, does not initialize memory for a data     structure, which allows remote attackers to cause a     denial of service or possibly have unspecified other     impact via a crafted character sequence.(CVE-2014-7940)

  - The Regular Expressions package in International     Components for Unicode (ICU) for C/C++ before     2014-12-03, as used in Google Chrome before     40.0.2214.91, calculates certain values without     ensuring that they can be represented in a 24-bit     field, which allows remote attackers to cause a denial     of service (memory corruption) or possibly have     unspecified other impact via a crafted string, a     related issue to CVE-2014-7923.(CVE-2014-9654)

  - Unspecified vulnerability in Oracle Java SE 6u101,     7u85, and 8u60, and Java SE Embedded 8u51, allows     remote attackers to affect confidentiality, integrity,     and availability via unknown vectors related to     2D.(CVE-2015-4844)

  - The uloc_acceptLanguageFromHTTP function in     common/uloc.cpp in International Components for Unicode     (ICU) through 57.1 for C/C++ does not ensure that there     is a '\0' character at the end of a certain temporary     array, which allows remote attackers to cause a denial     of service (out-of-bounds read) or possibly have     unspecified other impact via a call with a long     httpAcceptLanguage argument.(CVE-2016-6293)

  - International Components for Unicode (ICU) for C/C++     before 2017-02-13 has an out-of-bounds write caused by     a heap-based buffer overflow related to the     utf8TextAccess function in common/utext.cpp and the     utext_setNativeIndex* function.(CVE-2017-7867)

  - International Components for Unicode (ICU) for C/C++     before 2017-02-13 has an out-of-bounds write caused by     a heap-based buffer overflow related to the     utf8TextAccess function in common/utext.cpp and the     utext_moveIndex32* function.(CVE-2017-7868)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before     2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and     2.19.x before 2.19.1 allows remote code execution     during processing of a recursive 'git clone' of a     superproject if a .gitmodules file has a URL field     beginning with a '-' character.(CVE-2018-17456)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the mod_auth_mellon package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - mod_auth_mellon before 0.13.1 is vulnerable to a     Cross-Site Session Transfer attack, where a user with     access to one web site running on a server can copy     their session cookie to a different web site on the     same server to get access to that site.(CVE-2017-6807)

  - The am_read_post_data function in mod_auth_mellon     before 0.11.1 does not check if the ap_get_client_block     function returns an error, which allows remote     attackers to cause a denial of service (segmentation     fault and process crash) via a crafted POST     data.(CVE-2016-2145)

  - The am_read_post_data function in mod_auth_mellon     before 0.11.1 does not limit the amount of data read,     which allows remote attackers to cause a denial of     service (worker process crash, web server deadlock, or     memory consumption) via a large amount of POST     data.(CVE-2016-2146)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the pidgin package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An information leak exists in the handling of the MXIT     protocol in Pidgin. Specially crafted MXIT data sent     via the server could potentially result in an     out-of-bounds read. A malicious user, server, or     man-in-the-middle can send an invalid size for an     avatar which will trigger an out-of-bounds read     vulnerability. This could result in a denial of service     or copy data from memory to the file, resulting in an     information leak if the avatar is sent to another     user.(CVE-2016-2367)

  - A denial of service vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent from the server could     potentially result in an out-of-bounds read. A     malicious server or man-in-the-middle attacker can send     invalid data to trigger this     vulnerability.(CVE-2016-2370)

  - A denial of service vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could potentially     result in a null pointer dereference. A malicious     server or an attacker who intercepts the network     traffic can send invalid data to trigger this     vulnerability and cause a crash.(CVE-2016-2365)

  - A buffer overflow vulnerability exists in the handling     of the MXIT protocol Pidgin. Specially crafted data     sent via the server could potentially result in a     buffer overflow, potentially resulting in memory     corruption. A malicious server or an unfiltered     malicious user can send negative length values to     trigger this vulnerability.(CVE-2016-2378)

  - A denial of service vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could potentially     result in an out-of-bounds read. A malicious server or     an attacker who intercepts the network traffic can send     invalid data to trigger this vulnerability and cause a     crash.(CVE-2016-2366 )

  - Multiple memory corruption vulnerabilities exist in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could result in     multiple buffer overflows, potentially resulting in     code execution or memory disclosure.(CVE-2016-2368)

  - A NULL pointer dereference vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could potentially     result in a denial of service vulnerability. A     malicious server can send a packet starting with a NULL     byte triggering the vulnerability.(CVE-2016-2369)

  - An out-of-bounds write vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could cause     memory corruption resulting in code     execution.(CVE-2016-2371)

  - A denial of service vulnerability exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT data sent via the server could potentially     result in an out-of-bounds read. A malicious server or     user can send an invalid mood to trigger this     vulnerability.(CVE-2016-2373)

  - An exploitable memory corruption vulnerability exists     in the handling of the MXIT protocol in Pidgin.
    Specially crafted MXIT MultiMX message sent via the     server can result in an out-of-bounds write leading to     memory disclosure and code execution.(CVE-2016-2374)

  - An exploitable out-of-bounds read exists in the     handling of the MXIT protocol in Pidgin. Specially     crafted MXIT contact information sent from the server     can result in memory disclosure.(CVE-2016-2375)

  - A buffer overflow vulnerability exists in the handling     of the MXIT protocol in Pidgin. Specially crafted MXIT     data sent from the server could potentially result in     arbitrary code execution. A malicious server or an     attacker who intercepts the network traffic can send an     invalid size for a packet which will trigger a buffer     overflow.(CVE-2016-2376)

  - A buffer overflow vulnerability exists in the handling     of the MXIT protocol in Pidgin. Specially crafted MXIT     data sent by the server could potentially result in an     out-of-bounds write of one byte. A malicious server can     send a negative content-length in response to a HTTP     request triggering the vulnerability.(CVE-2016-2377)

  - An information leak exists in the handling of the MXIT     protocol in Pidgin. Specially crafted MXIT data sent to     the server could potentially result in an out-of-bounds     read. A user could be convinced to enter a particular     string which would then get converted incorrectly and     could lead to a potential out-of-bounds     read.(CVE-2016-2380)

  - A directory traversal exists in the handling of the     MXIT protocol in Pidgin. Specially crafted MXIT data     sent from the server could potentially result in an     overwrite of files. A malicious server or someone with     access to the network traffic can provide an invalid     filename for a splash image triggering the     vulnerability.(CVE-2016-4323)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the gdk-pixbuf2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Integer overflow in io-ico.c in gdk-pixbuf allows     context-dependent attackers to cause a denial of     service (segmentation fault and application crash) via     a crafted image entry offset in an ICO file, which     triggers an out-of-bounds read, related to compiler     optimizations.(CVE-2017-6312)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the audit packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Audit before 2.4.4 in Linux does not sanitize escape     characters in filenames.(CVE-2015-5186)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the rpm packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was found that rpm did not properly handle RPM     installations when a destination path was a symbolic     link to a directory, possibly changing ownership and     permissions of an arbitrary directory, and RPM files     being placed in an arbitrary destination. An attacker,     with write access to a directory in which a     subdirectory will be installed, could redirect that     directory to an arbitrary location and gain root     privilege.(CVE-2017-7500)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libpng packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Integer overflow in the png_set_unknown_chunks function     in libpng/pngset.c in libpng before 1.5.14beta08 allows     context-dependent attackers to cause a denial of     service (segmentation fault and crash) via a crafted     image, which triggers a heap-based buffer     overflow.(CVE-2013-7353)

  - Multiple integer overflows in libpng before 1.5.14rc03     allow remote attackers to cause a denial of service     (crash) via a crafted image to the (1) png_set_sPLT or     (2) png_set_text_2 function, which triggers a     heap-based buffer overflow.(CVE-2013-7354)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the lua package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Buffer overflow in the vararg functions in ldo.c in Lua     5.1 through 5.2.x before 5.2.3 allows context-dependent     attackers to cause a denial of service (crash) via a     small number of arguments to a function with a large     number of fixed arguments.(CVE-2014-5461)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the qt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - QXmlSimpleReader in Qt before 5.2 allows     context-dependent attackers to cause a denial of     service (memory consumption) via an XML Entity     Expansion (XEE) attack.(CVE-2013-4549)

  - An issue was discovered in Qt before 5.11.3. There is     QTgaFile Uncontrolled Resource     Consumption.(CVE-2018-19871)

  - QXmlStream in Qt 5.x before 5.11.3 has a double-free or     corruption during parsing of a specially crafted     illegal XML document.(CVE-2018-15518)

  - An issue was discovered in Qt 5.11. A malformed PPM     image causes a division by zero and a crash in     qppmhandler.cpp.(CVE-2018-19872)

  - Multiple buffer overflows in gui/image/qbmphandler.cpp     in the QtBase module in Qt before 4.8.7 and 5.x before     5.4.2 allow remote attackers to cause a denial of     service (segmentation fault and crash) and possibly     execute arbitrary code via a crafted BMP     image.(CVE-2015-1858)

  - Multiple buffer overflows in     plugins/imageformats/ico/qicohandler.cpp in the QtBase     module in Qt before 4.8.7 and 5.x before 5.4.2 allow     remote attackers to cause a denial of service     (segmentation fault and crash) and possibly execute     arbitrary code via a crafted ICO image.(CVE-2015-1859)

  - Multiple buffer overflows in gui/image/qgifhandler.cpp     in the QtBase module in Qt before 4.8.7 and 5.x before     5.4.2 allow remote attackers to cause a denial of     service (segmentation fault) and possibly execute     arbitrary code via a crafted GIF image.(CVE-2015-1860)

  - The BMP decoder in QtGui in QT before 5.5 does not     properly calculate the masks used to extract the color     components, which allows remote attackers to cause a     denial of service (divide-by-zero and crash) via a     crafted BMP file.(CVE-2015-0295)

  - The GIF decoder in QtGui in Qt before 5.3 allows remote     attackers to cause a denial of service (NULL pointer     dereference) via invalid width and height values in a     GIF image.(CVE-2014-0190)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bluez packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In BlueZ 5.42, a use-after-free was identified in     'conf_opt' function in 'tools/parser/l2cap.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in hcidump     crash.(CVE-2016-9798)

  - In BlueZ 5.42, a buffer overflow was observed in     'pin_code_reply_dump' function in 'tools/parser/hci.c'     source file. The issue exists because 'pin' array is     overflowed by supplied parameter due to lack of     boundary checks on size of the buffer from frame     'pin_code_reply_cp *cp' parameter.(CVE-2016-9800)

  - In BlueZ 5.42, a buffer overflow was observed in     'set_ext_ctrl' function in 'tools/parser/l2cap.c'     source file when processing corrupted dump     file.(CVE-2016-9801)

  - In BlueZ 5.42, a buffer over-read was identified in     'l2cap_packet' function in 'monitor/packet.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in btmon     crash.(CVE-2016-9802)

  - In BlueZ 5.42, a buffer overflow was observed in     'commands_dump' function in 'tools/parser/csr.c' source     file. The issue exists because 'commands' array is     overflowed by supplied parameter due to lack of     boundary checks on size of the buffer from frame     'frm->ptr' parameter. This issue can be triggered by     processing a corrupted dump file and will result in     hcidump crash.(CVE-2016-9804)

  - In BlueZ 5.42, a buffer overflow was observed in     'read_n' function in 'tools/hcidump.c' source file.
    This issue can be triggered by processing a corrupted     dump file and will result in hcidump     crash.(CVE-2016-9917)

  - In BlueZ 5.42, an out-of-bounds read was identified in     'packet_hexdump' function in 'monitor/packet.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in btmon     crash.(CVE-2016-9918)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libarchive package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - archive_read_format_rar_read_data in     archive_read_support_format_rar.c in libarchive before     3.4.0 has a use-after-free in a certain ARCHIVE_FAILED     situation, related to     Ppmd7_DecodeSymbol.(CVE-2019-18408)

  - Absolute path traversal vulnerability in bsdcpio in     libarchive 3.1.2 and earlier allows remote attackers to     write to arbitrary files via a full pathname in an     archive.(CVE-2015-2304)

  - Integer overflow in the archive_read_format_tar_skip     function in archive_read_support_format_tar.c in     libarchive before 3.2.0 allows remote attackers to     cause a denial of service (crash) via a crafted tar     file.(CVE-2015-8933)

  - The archive_wstring_append_from_mbs function in     archive_string.c in libarchive 3.2.2 allows remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) via a crafted     archive file.(CVE-2016-10209)

  - An error in the lha_read_file_header_1() function     (archive_read_support_format_lha.c) in libarchive 3.2.2     allows remote attackers to trigger an out-of-bounds     read memory access and subsequently cause a crash via a     specially crafted archive.(CVE-2017-5601)

  - read_header in archive_read_support_format_rar.c in     libarchive 3.3.2 suffers from an off-by-one error for     UTF-16 names in RAR archives, leading to an     out-of-bounds read in     archive_read_format_rar_read_header.(CVE-2017-14502)

  - The read_Header function in     archive_read_support_format_7zip.c in libarchive 3.2.1     allows remote attackers to cause a denial of service     (out-of-bounds read) via multiple EmptyStream     attributes in a header in a 7zip     archive.(CVE-2016-8689)

  - Stack-based buffer overflow in the safe_fprintf     function in tar/util.c in libarchive 3.2.1 allows     remote attackers to cause a denial of service via a     crafted non-printable multibyte character in a     filename.(CVE-2016-8687)

  - libarchive 3.3.2 suffers from an out-of-bounds read     within lha_read_data_none() in     archive_read_support_format_lha.c when extracting a     specially crafted lha archive, related to     lha_crc16.(CVE-2017-14503)

  - The mtree bidder in libarchive 3.2.1 does not keep     track of line sizes when extending the read-ahead,     which allows remote attackers to cause a denial of     service (crash) via a crafted file, which triggers an     invalid read in the (1) detect_form or (2) bid_entry     function in     libarchive/archive_read_support_format_mtree.c.(CVE-201     6-8688)

  - The archive_le32dec function in archive_endian.h in     libarchive 3.2.2 allows remote attackers to cause a     denial of service (heap-based buffer over-read and     application crash) via a crafted file.(CVE-2016-10349)

  - The archive_read_format_cab_read_header function in     archive_read_support_format_cab.c in libarchive 3.2.2     allows remote attackers to cause a denial of service     (heap-based buffer over-read and application crash) via     a crafted file.(CVE-2016-10350)

  - libarchive version commit     416694915449219d505531b1096384f3237dd6cc onwards     (release v3.1.0 onwards) contains a CWE-416: Use After     Free vulnerability in RAR decoder -     libarchive/archive_read_support_format_rar.c that can     result in Crash/DoS - it is unknown if RCE is possible.
    This attack appear to be exploitable via the victim     must open a specially crafted RAR     archive.(CVE-2018-1000878)

  - libarchive version commit     416694915449219d505531b1096384f3237dd6cc onwards     (release v3.1.0 onwards) contains a CWE-415: Double     Free vulnerability in RAR decoder -     libarchive/archive_read_support_format_rar.c,     parse_codes(), realloc(rar->lzss.window, new_size) with     new_size = 0 that can result in Crash/DoS. This attack     appear to be exploitable via the victim must open a     specially crafted RAR archive.(CVE-2018-1000877)

  - bsdcpio in libarchive before 3.2.0 allows remote     attackers to cause a denial of service (invalid read     and crash) via crafted cpio file.(CVE-2015-8915)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A Reachable Assertion issue was discovered in the KDC     in MIT Kerberos 5 (aka krb5) before 1.17. If an     attacker can obtain a krbtgt ticket using an older     encryption type (single-DES, triple-DES, or RC4), the     attacker can crash the KDC by making an S4U2Self     request.(CVE-2018-20217)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the firewalld packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - firewalld.py in firewalld before 0.4.3.3 allows local     users to bypass authentication and modify firewall     configurations via the (1) addPassthrough, (2)     removePassthrough, (3) addEntry, (4) removeEntry, or     (5) setEntries D-Bus API method.(CVE-2016-5410)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the elinks package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - ELinks 0.12 and Twibright Links 2.3 have Missing SSL     Certificate Validation.(CVE-2012-6709)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the exiv2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Exiv2 0.26, Exiv2::IptcParser::decode in iptc.cpp     (called from psdimage.cpp in the PSD image reader) may     suffer from a denial of service (heap-based buffer     over-read) caused by an integer overflow via a crafted     PSD image file.(CVE-2018-19107)

  - In Exiv2 0.26, Exiv2::PsdImage::readMetadata in     psdimage.cpp in the PSD image reader may suffer from a     denial of service (infinite loop) caused by an integer     overflow via a crafted PSD image file.(CVE-2018-19108)

  - There is a SEGV in     Exiv2::Internal::TiffParserWorker::findPrimaryGroups of     tiffimage_int.cpp in Exiv2 0.27-RC3. A crafted input     will lead to a remote denial of service     attack.(CVE-2018-20097)

  - Exiv2 through 0.27.1 allows an attacker to cause a     denial of service (crash due to assertion failure) via     an invalid data location in a CRW image     file.(CVE-2019-13113)

  - A PngChunk::parseChunkContent uncontrolled memory     allocation in Exiv2 through 0.27.1 allows an attacker     to cause a denial of service (crash due to an     std::bad_alloc exception) via a crafted PNG image     file.(CVE-2019-13112)

  - A CiffDirectory::readDirectory integer overflow and     out-of-bounds read in Exiv2 through 0.27.1 allows an     attacker to cause a denial of service (SIGSEGV) via a     crafted CRW image file.(CVE-2019-13110)

  - Exiv2 0.26 has a Null Pointer Dereference in the     Exiv2::DataValue::toLong function in value.cpp, related     to crafted metadata in a TIFF file.(CVE-2017-18005)

  - An issue was discovered in Exiv2 0.26. When the data     structure of the structure ifd is incorrect, the     program assigns pValue_ to 0x0, and the value of     pValue() is 0x0. TiffImageEntry::doWriteImage will use     the value of pValue() to cause a segmentation fault. To     exploit this vulnerability, someone must open a crafted     tiff file.(CVE-2017-9239)

  - In types.cpp in Exiv2 0.26, a large size value may lead     to a SIGABRT during an attempt at memory allocation for     an Exiv2::Internal::PngChunk::zlibUncompress     call.(CVE-2018-10958)

  - An issue was discovered in Exiv2 0.26. The     Exiv2::Internal::PngChunk::parseTXTChunk function has a     heap-based buffer over-read.(CVE-2018-10999)

  - An issue was discovered in Exiv2 0.26. readMetadata in     jp2image.cpp allows remote attackers to cause a denial     of service (SIGABRT) by triggering an incorrect     Safe::add call.(CVE-2018-10998)

  - There is a Floating point exception in the     Exiv2::ValueType function in Exiv2 0.26 that will lead     to a remote denial of service attack via crafted     input.(CVE-2017-11591)

  - There is a reachable assertion in the     Internal::TiffReader::visitDirectory function in     tiffvisitor.cpp of Exiv2 0.26 that will lead to a     remote denial of service attack via crafted     input.(CVE-2017-11683)

  - An Invalid memory address dereference was discovered in     Exiv2::StringValueBase::read in value.cpp in Exiv2     0.26. The vulnerability causes a segmentation fault and     application crash, which leads to denial of     service.(CVE-2017-14859)

  - An Invalid memory address dereference was discovered in     Exiv2::DataValue::read in value.cpp in Exiv2 0.26. The     vulnerability causes a segmentation fault and     application crash, which leads to denial of     service.(CVE-2017-14862)

  - An Invalid memory address dereference was discovered in     Exiv2::getULong in types.cpp in Exiv2 0.26. The     vulnerability causes a segmentation fault and     application crash, which leads to denial of     service.(CVE-2017-14864)

  - There is a heap-based buffer over-read in the     Exiv2::Internal::PngChunk::keyTXTChunk function of     pngchunk_int.cpp in Exiv2 0.26. A crafted PNG file will     lead to a remote denial of service     attack.(CVE-2017-17669)

  - CiffDirectory::readDirectory() at crwimage_int.cpp in     Exiv2 0.26 has excessive stack consumption due to a     recursive function, leading to Denial of     service.(CVE-2018-17581)

  - In Exiv2 0.26 and previous versions,     PngChunk::readRawProfile in pngchunk_int.cpp may cause     a denial of service (application crash due to a     heap-based buffer over-read) via a crafted PNG     file.(CVE-2018-19535)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Vulnerability in the Java SE, Java SE Embedded     component of Oracle Java SE (subcomponent: Networking).
    Supported versions that are affected are Java SE:
    7u221, 8u212, 11.0.3 and 12.0.1 Java SE Embedded:
    8u211. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded. Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access     to some of Java SE, Java SE Embedded accessible data as     well as unauthorized read access to a subset of Java     SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications     or sandboxed Java applets (in Java SE 8), that load and     run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security.
    This vulnerability can also be exploited by using APIs     in the specified Component, e.g., through a web service     which supplies data to the APIs. CVSS 3.0 Base Score     4.8 (Confidentiality and Integrity impacts). CVSS     Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-201     9-2816)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the exempi package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in Exempi before 2.4.4. Integer     overflow in the Chunk class in     XMPFiles/source/FormatSupport/RIFF.cpp allows remote     attackers to cause a denial of service (infinite loop)     via crafted XMP data in a .avi file.(CVE-2017-18233)

  - An issue was discovered in Exempi before 2.4.4. The     ASF_Support::ReadHeaderObject function in     XMPFiles/source/FormatSupport/ASF_Support.cpp allows     remote attackers to cause a denial of service (infinite     loop) via a crafted .asf file.(CVE-2017-18236)

  - An issue was discovered in Exempi before 2.4.4. The     TradQT_Manager::ParseCachedBoxes function in     XMPFiles/source/FormatSupport/QuickTime_Support.cpp     allows remote attackers to cause a denial of service     (infinite loop) via crafted XMP data in a .qt     file.(CVE-2017-18238)

  - An issue was discovered in Exempi through 2.4.4. A     certain case of a 0xffffffff length is mishandled in     XMPFiles/source/FormatSupport/PSIR_FileWriter.cpp,     leading to a heap-based buffer over-read in the     PSD_MetaHandler::CacheFileData()     function.(CVE-2018-7730)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Severity
131914	EulerOS 2.0 SP2 : vim (EulerOS-SA-2019-2462)	Low
131913	EulerOS 2.0 SP2 : xorg-x11-server (EulerOS-SA-2019-2421)	High
131912	EulerOS 2.0 SP2 : ncurses (EulerOS-SA-2019-2420)	High
131911	EulerOS 2.0 SP2 : perl (EulerOS-SA-2019-2419)	High
131910	EulerOS 2.0 SP2 : rsyslog (EulerOS-SA-2019-2418)	High
131909	EulerOS 2.0 SP2 : coreutils (EulerOS-SA-2019-2417)	Low
131908	EulerOS 2.0 SP2 : libgxps (EulerOS-SA-2019-2416)	Medium
131907	EulerOS 2.0 SP2 : perl-Archive-Tar (EulerOS-SA-2019-2415)	Medium
131906	EulerOS 2.0 SP2 : sudo (EulerOS-SA-2019-2414)	High
131905	EulerOS 2.0 SP2 : wavpack (EulerOS-SA-2019-2413)	Medium
131904	EulerOS 2.0 SP2 : foomatic (EulerOS-SA-2019-2412)	High
131903	EulerOS 2.0 SP2 : bzip2 (EulerOS-SA-2019-2411)	Medium
131902	EulerOS 2.0 SP2 : curl (EulerOS-SA-2019-2410)	High
131901	EulerOS 2.0 SP2 : glib2 (EulerOS-SA-2019-2409)	High
131900	EulerOS 2.0 SP2 : quagga (EulerOS-SA-2019-2408)	High
131899	EulerOS 2.0 SP2 : libjpeg-turbo (EulerOS-SA-2019-2407)	Medium
131898	EulerOS 2.0 SP2 : gpgme (EulerOS-SA-2019-2406)	Medium
131897	EulerOS 2.0 SP2 : dom4j (EulerOS-SA-2019-2405)	Medium
131896	EulerOS 2.0 SP2 : polkit (EulerOS-SA-2019-2404)	Medium
131895	EulerOS 2.0 SP2 : ruby (EulerOS-SA-2019-2403)	High
131894	EulerOS 2.0 SP2 : httpd (EulerOS-SA-2019-2402)	Medium
131893	EulerOS 2.0 SP2 : lcms2 (EulerOS-SA-2019-2401)	Medium
131892	EulerOS 2.0 SP2 : policycoreutils (EulerOS-SA-2019-2400)	Low
131891	EulerOS 2.0 SP2 : ppp (EulerOS-SA-2019-2399)	High
131890	EulerOS 2.0 SP2 : libsamplerate (EulerOS-SA-2019-2398)	Medium
131889	EulerOS 2.0 SP2 : jakarta-commons-httpclient (EulerOS-SA-2019-2397)	Medium
131888	EulerOS 2.0 SP2 : jansson (EulerOS-SA-2019-2396)	Medium
131887	EulerOS 2.0 SP2 : libplist (EulerOS-SA-2019-2395)	Medium
131886	EulerOS 2.0 SP2 : openslp (EulerOS-SA-2019-2394)	High
131885	EulerOS 2.0 SP2 : gnupg2 (EulerOS-SA-2019-2393)	Medium
131884	EulerOS 2.0 SP2 : libidn (EulerOS-SA-2019-2392)	Medium
131883	EulerOS 2.0 SP2 : memcached (EulerOS-SA-2019-2391)	Medium
131882	EulerOS 2.0 SP2 : icu (EulerOS-SA-2019-2390)	Critical
131881	EulerOS 2.0 SP2 : git (EulerOS-SA-2019-2389)	High
131880	EulerOS 2.0 SP2 : mod_auth_mellon (EulerOS-SA-2019-2388)	Medium
131879	EulerOS 2.0 SP2 : pidgin (EulerOS-SA-2019-2387)	High
131878	EulerOS 2.0 SP2 : gdk-pixbuf2 (EulerOS-SA-2019-2386)	Medium
131877	EulerOS 2.0 SP2 : audit (EulerOS-SA-2019-2385)	Medium
131876	EulerOS 2.0 SP2 : rpm (EulerOS-SA-2019-2384)	High
131875	EulerOS 2.0 SP2 : libpng (EulerOS-SA-2019-2383)	Medium
131874	EulerOS 2.0 SP2 : lua (EulerOS-SA-2019-2382)	Medium
131873	EulerOS 2.0 SP2 : qt (EulerOS-SA-2019-2381)	Medium
131872	EulerOS 2.0 SP2 : bluez (EulerOS-SA-2019-2380)	Medium
131871	EulerOS 2.0 SP2 : libarchive (EulerOS-SA-2019-2379)	Medium
131870	EulerOS 2.0 SP2 : krb5 (EulerOS-SA-2019-2378)	Low
131869	EulerOS 2.0 SP2 : firewalld (EulerOS-SA-2019-2377)	Low
131868	EulerOS 2.0 SP2 : elinks (EulerOS-SA-2019-2376)	Medium
131867	EulerOS 2.0 SP2 : exiv2 (EulerOS-SA-2019-2375)	Medium
131866	EulerOS 2.0 SP2 : java-1.8.0-openjdk (EulerOS-SA-2019-2374)	Medium
131865	EulerOS 2.0 SP2 : exempi (EulerOS-SA-2019-2373)	Medium

Huawei Local Security Checks Family for Nessus