According to the version of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - In Perl through 5.26.2, the Archive::Tar module allows     remote attackers to bypass a directory-traversal     protection mechanism, and overwrite arbitrary files,     via an archive file containing a symlink and a regular     file with the same name.(CVE-2018-12015)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the ghostscript package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - Integer overflow in the gs_heap_alloc_bytes function in     base/gsmalloc.c in Ghostscript 9.15 and earlier allows     remote attackers to cause a denial of service (crash)     via a crafted Postscript (ps) file, as demonstrated by     using the ps2pdf command, which triggers an     out-of-bounds read or write.(CVE-2015-3228)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ghostscript package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The set_text_distance function in     devices/vector/gdevpdts.c in the pdfwrite component in     Artifex Ghostscript through 9.22 does not prevent     overflows in text-positioning calculation, which allows     remote attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact via a crafted PDF document.(CVE-2018-10194)

  - In Artifex Ghostscript before 9.24, attackers able to     supply crafted PostScript files could use a type     confusion in the LockDistillerParams parameter to crash     the interpreter or execute code.(CVE-2018-15910)

  - An issue was discovered in Artifex Ghostscript before     9.24. Incorrect 'restoration of privilege' checking     during handling of /invalidaccess exceptions could be     used by attackers able to supply crafted PostScript to     execute code using the 'pipe'     instruction.(CVE-2018-16509)

  - In Artifex Ghostscript before 9.24, attackers able to     supply crafted PostScript files could use insufficient     interpreter stack-size checking during error handling     to crash the interpreter.(CVE-2018-16542)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - stdlib/canonicalize.c in the GNU C Library (aka glibc     or libc6) 2.27 and earlier, when processing very long     pathname arguments to the realpath function, could     encounter an integer overflow on 32-bit architectures,     leading to a stack-based buffer overflow and,     potentially, arbitrary code execution.(CVE-2018-11236)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the wget package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - GNU Wget before 1.19.5 is prone to a cookie injection     vulnerability in the resp_new function in http.c via a     \r\n sequence in a continuation line.(CVE-2018-0494)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The OpenSSL RSA Key generation algorithm has been shown     to be vulnerable to a cache timing side channel attack.
    An attacker with sufficient access to mount cache     timing attacks during the RSA key generation process     could recover the private key. Fixed in OpenSSL     1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL     1.0.2p-dev (Affected 1.0.2b-1.0.2o).(CVE-2018-0737)

  - While parsing an IPAddressFamily extension in an X.509     certificate, it is possible to do a one-byte overread.
    This would result in an incorrect text display of the     certificate. This bug has been present since 2006 and     is present in all versions of OpenSSL before 1.0.2m and     1.1.0g.(CVE-2017-3735)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the curl package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - When doing a TFTP transfer and curl/libcurl is given a     URL that contains a very long file name (longer than     about 515 bytes), the file name is truncated to fit     within the buffer boundaries, but the buffer size is     still wrongly updated to use the untruncated length.
    This too large value is then used in the sendto() call,     making curl attempt to send more data than what is     actually put into the buffer. The endto() function will     then read beyond the end of the heap based buffer. A     malicious HTTP(S) server could redirect a vulnerable     libcurl-using client to a crafted TFTP URL (if the     client hasn't restricted which protocols it allows     redirects to) and trick it to send private memory     contents to a remote server over UDP. Limit curl's     redirect protocols with --proto-redir and libcurl's     with CURLOPT_REDIR_PROTOCOLS.(CVE-2017-1000100)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libtasn1 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - Two errors in the 'asn1_find_node()' function     (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10     can be exploited to cause a stacked-based buffer     overflow by tricking a user into processing a specially     crafted assignments file via the e.g. asn1Coding     utility.(CVE-2017-6891)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - 'deny-answer-aliases' is a little-used feature intended     to help recursive server operators protect end users     against DNS rebinding attacks, a potential method of     circumventing the security model used by client     browsers. However, a defect in this feature makes it     easy, when the feature is in use, to experience an     assertion failure in name.c. Affects BIND 9.7.0->9.8.8,     9.9.0->9.9.13, 9.10.0->9.10.8, 9.11.0->9.11.4,     9.12.0->9.12.2, 9.13.0->9.13.2.(CVE-2018-5740)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the yum-utils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A directory traversal issue was found in reposync, a     part of yum-utils, where reposync fails to sanitize     paths in remote repository configuration files. If an     attacker controls a repository, they may be able to     copy files outside of the destination directory on the     targeted system via path traversal. If reposync is     running with heightened privileges on a targeted     system, this flaw could potentially result in system     compromise via the overwriting of critical system     files. Version 1.1.31 and older are believed to be     affected.(CVE-2018-10897)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libjpeg-turbo package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - libjpeg 9c has a large loop because read_pixel in     rdtarga.c mishandles EOF.(CVE-2018-11813)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the gnupg2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - mainproc.c in GnuPG before 2.2.8 mishandles the     original filename during decryption and verification     actions, which allows remote attackers to spoof the     output that GnuPG sends on file descriptor 2 to other     programs that use the '--status-fd 2' option. For     example, the OpenPGP data might represent an original     filename that contains line feed characters in     conjunction with GOODSIG or VALIDSIG status     codes.(CVE-2018-12020)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A security flaw was found in the ip_frag_reasm()     function in net/ipv4/ip_fragment.c in the Linux kernel     which can cause a later system crash in     ip_do_fragment(). With certain non-default, but     non-rare, configuration of a victim host, an attacker     can trigger this crash remotely, thus leading to a     remote denial of service.(CVE-2018-14641)

  - A flaw named FragmentSmack was found in the way the     Linux kernel handled reassembly of fragmented IPv4 and     IPv6 packets. A remote attacker could use this flaw to     trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted     packets which could lead to a CPU saturation and hence     a denial of service on the system.(CVE-2018-5391)

  - The resv_map_release function in mm/hugetlb.c in the     Linux kernel, through 4.15.7, allows local users to     cause a denial of service (BUG) via a crafted     application that makes mmap system calls and has a     large pgoff argument to the remap_file_pages system     call. (CVE-2018-7740)

  - A use-after-free vulnerability was found in the way the     Linux kernel's KVM hypervisor emulates a preemption     timer for L2 guests when nested (=1) virtualization is     enabled. This high resolution timer(hrtimer) runs when     a L2 guest is active. After VM exit, the sync_vmcs12()     timer object is stopped. The use-after-free occurs if     the timer object is freed before calling sync_vmcs12()     routine. A guest user/process could use this flaw to     crash the host kernel resulting in a denial of service     or, potentially, gain privileged access to a system.
    (CVE-2019-7221)

  - An information leakage issue was found in the way Linux     kernel's KVM hypervisor handled page fault exceptions     while emulating instructions like VMXON, VMCLEAR,     VMPTRLD, and VMWRITE with memory address as an operand.
    It occurs if the operand is a mmio address, as the     returned exception object holds uninitialized stack     memory contents. A guest user/process could use this     flaw to leak host's stack memory contents to a guest.
    (CVE-2019-7222)

  - The xfs_dinode_verify function in     fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel can     cause a NULL pointer dereference in     xfs_ilock_attr_map_shared function. An attacker could     trick a legitimate user or a privileged attacker could     exploit this by mounting a crafted xfs filesystem image     to cause a kernel panic and thus a denial of service.
    (CVE-2018-10322)

  - The Linux kernel is vulnerable to a NULL pointer     dereference in the     ext4/mballoc.c:ext4_process_freed_data() function. An     attacker could trick a legitimate user or a privileged     attacker could exploit this by mounting a crafted ext4     image to cause a kernel panic.(CVE-2018-1092)

  - The Linux kernel is vulnerable to a NULL pointer     dereference in the ext4/xattr.c:ext4_xattr_inode_hash()     function. An attacker could trick a legitimate user or     a privileged attacker could exploit this to cause a     NULL pointer dereference with a crafted ext4 image.
    (CVE-2018-1094)

  - An issue was discovered in the XFS filesystem in     fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel. A     NULL pointer dereference may occur for a corrupted xfs     image after xfs_da_shrink_inode() is called with a NULL     bp. This can lead to a system crash and a denial of     service. (CVE-2018-13094)

  - A flaw was found in the Linux kernel with files on     tmpfs and hugetlbfs. An attacker is able to bypass file     permissions on filesystems mounted with tmpfs/hugetlbs     to modify a file and possibly disrupt normal system     behavior. At this time there is an understanding there     is no crash or privilege escalation but the impact of     modifications on these filesystems of files in     production systems may have adverse affects.
    (CVE-2018-18397)

  - A use-after-free flaw can occur in the Linux kernel due     to a race condition between packet_do_bind() and     packet_notifier() functions called for an AF_PACKET     socket. An unprivileged, local user could use this flaw     to induce kernel memory corruption on the system,     leading to an unresponsive system or to a crash. Due to     the nature of the flaw, privilege escalation cannot be     fully ruled out. (CVE-2018-18559)

  - A flaw was found In the Linux kernel, through version     4.19.6, where a local user could exploit a     use-after-free in the ALSA driver by supplying a     malicious USB Sound device (with zero interfaces) that     is mishandled in usb_audio_probe in sound/usb/card.c.
    An attacker could corrupt memory and possibly escalate     privileges if the attacker is able to have physical     access to the system.(CVE-2018-19824)

  - An issue was discovered in the Linux kernel before     4.18.11. The ipddp_ioctl function in     drivers/net/appletalk/ipddp.c allows local users to     obtain sensitive kernel address information by     leveraging CAP_NET_ADMIN to read the ipddp_route dev     and next fields via an SIOCFINDIPDDPRT ioctl call.
    (CVE-2018-20511)

  - A use-after-free vulnerability was found in the way the     Linux kernel's KVM hypervisor implements its device     control API. While creating a device via     kvm_ioctl_create_device(), the device holds a reference     to a VM object, later this reference is transferred to     the caller's file descriptor table. If such file     descriptor was to be closed, reference count to the VM     object could become zero, potentially leading to a     use-after-free issue. A user/process could use this     flaw to crash the guest VM resulting in a denial of     service issue or, potentially, gain privileged access     to a system. (CVE-2019-6974)

  - Since Linux kernel version 3.2, the mremap() syscall     performs TLB flushes after dropping pagetable locks. If     a syscall such as ftruncate() removes entries from the     pagetables of a task that is in the middle of mremap(),     a stale TLB entry can remain for a short time that     permits access to a physical page after it has been     released back to the page allocator and     reused.(CVE-2018-18281)

  - A division-by-zero in set_termios(), when debugging is     enabled, was found in the Linux kernel. When the     [io_ti] driver is loaded, a local unprivileged attacker     can request incorrect high transfer speed in the     change_port_settings() in the     drivers/usb/serial/io_ti.c so that the divisor value     becomes zero and causes a system crash resulting in a     denial of service. (CVE-2017-18360)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the spice package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - spice: Off-by-one error in array access in     spice/server/memslot.c (CVE-2019-3813)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in the way runc handled system file     descriptors when running containers. A malicious     container could use this flaw to overwrite contents of     the runc binary and consequently run arbitrary commands     on the container host system. (CVE-2019-5736)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the rsyslog packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A denial of service vulnerability was found in rsyslog     in the imptcp module. An attacker could send a     specially crafted message to the imptcp socket, which     would cause rsyslog to crash.(CVE-2018-16881)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - python: DOS via regular expression backtracking in     difflib.IS_LINE_JUNK method in difflib (CVE-2018-1061)

  - python: DOS via regular expression catastrophic     backtracking in apop() method in pop3lib     (CVE-2018-1060)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the poppler packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - poppler: heap-based buffer over-read in XRef::getEntry     in XRef.cc(CVE-2019-7310)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the polkit packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - polkit: Temporary auth hijacking via PID reuse and     non-atomic fork (CVE-2019-6133)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An infinite loop vulnerability was found in     ext/iconv/iconv.c in PHP due to the iconv stream not     rejecting invalid multibyte sequences. A remote     attacker could use this vulnerability to hang the php     process and consume resources.(CVE-2018-10546)

  - gdImageColorMatch in gd_color_match.c in the GD     Graphics Library (aka LibGD) 2.2.5, as used in the     imagecolormatch function in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1, has a heap-based buffer overflow. This can be     exploited by an attacker who is able to trigger     imagecolormatch calls with crafted image     data.(CVE-2019-6977)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libvncserver package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - LibVNC before 0.9.12 contains multiple heap     out-of-bounds write vulnerabilities in     libvncclient/rfbproto.c. The fix for CVE-2018-20019 was     incomplete.(CVE-2018-20748)

  - LibVNC before 0.9.12 contains a heap out-of-bounds     write vulnerability in libvncserver/rfbserver.c. The     fix for CVE-2018-15127 was incomplete.(CVE-2018-20749)

  - LibVNC through 0.9.12 contains a heap out-of-bounds     write vulnerability in libvncserver/rfbserver.c. The     fix for CVE-2018-15127 was incomplete.(CVE-2018-20750)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libarchive package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - libarchive version commit     416694915449219d505531b1096384f3237dd6cc onwards     (release v3.1.0 onwards) contains a CWE-415: Double     Free vulnerability in RAR decoder -     libarchive/archive_read_support_format_rar.c,     parse_codes(), realloc(rar->lzss.window, new_size) with     new_size = 0 that can result in Crash/DoS. This attack     appear to be exploitable via the victim must open a     specially crafted RAR archive.(CVE-2018-1000877)

  - libarchive version commit     416694915449219d505531b1096384f3237dd6cc onwards     (release v3.1.0 onwards) contains a CWE-416: Use After     Free vulnerability in RAR decoder -     libarchive/archive_read_support_format_rar.c that can     result in Crash/DoS - it is unknown if RCE is possible.
    This attack appear to be exploitable via the victim     must open a specially crafted RAR     archive.(CVE-2018-1000878)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the irssi package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Irssi 1.1.x before 1.1.2 has a use after free when     hidden lines are expired from the scroll     buffer.(CVE-2019-5882)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ghostscript: access bypass in psi/zdevice2.c (700153)     (CVE-2018-19475)

  - ghostscript: access bypass in psi/zicc.c (700169)     (CVE-2018-19476)

  - ghostscript: access bypass in psi/zfjbig2.c (700168)     (CVE-2018-19477)

  - ghostscript: subroutines within pseudo-operators must     themselves be pseudo-operators (700317) (CVE-2019-6116)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the gd package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The GD Graphics Library (aka LibGD) 2.2.5 has a double     free in the gdImage*Ptr() functions in gd_gif_out.c,     gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is     unaffected.(CVE-2019-6987)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the systemd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - In systemd through 233, certain sizes passed to     dns_packet_new in systemd-resolved can cause it to     allocate a buffer that's too small. A malicious DNS     server can exploit this via a response with a specially     crafted TCP payload to trick systemd-resolved into     allocating a buffer that's too small, and subsequently     write arbitrary data beyond the end of     it.(CVE-2017-9445)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Missing check in fs/inode.c:inode_init_owner() does not     clear SGID bit on non-directories for     non-members.(CVE-2018-13405)

  - A null pointer dereference in dccp_write_xmit()     function in net/dccp/output.c in the Linux kernel     allows a local user to cause a denial of service by a     number of certain crafted system calls.(CVE-2018-1130)

  - A flaw was found in the Linux kernel, before 4.16.6     where the cdrom_ioctl_media_changed function in     drivers/cdrom/cdrom.c allows local attackers to use a     incorrect bounds check in the CDROM driver     CDROM_MEDIA_CHANGED ioctl to read out kernel     memory.(CVE-2018-10940)

  - The madvise_willneed function in the Linux kernel     allows local users to cause a denial of service     (infinite loop) by triggering use of MADVISE_WILLNEED     for a DAX mapping.(CVE-2017-18208)

  - fuse-backed file mmap-ed onto process cmdline arguments     causes denial of service.(CVE-2018-1120)

  - Memory leak in the sas_smp_get_phy_events function in     drivers/scsi/libsas/sas_expander.c in the Linux kernel     allows local users to cause a denial of service (kernel     memory exhaustion) via multiple read accesses to files     in the /sys/class/sas_phy directory.(CVE-2018-7757)

  - A vulnerability was found in the Linux kernel's     kernel/events/core.c:perf_cpu_time_max_percent_handler(     ) function. Local privileged users could exploit this     flaw to cause a denial of service due to integer     overflow or possibly have unspecified other     impact.(CVE-2017-18255)

  - A flaw was found in the Linux kernel in the way a local     user could create keyrings for other users via keyctl     commands. This may allow an attacker to set unwanted     defaults, a denial of service, or possibly leak keyring     information between users.(CVE-2017-18270)

  - The mm subsystem in the Linux kernel through 4.10.10     does not properly enforce the CONFIG_STRICT_DEVMEM     protection mechanism, which allows local users to read     or write to kernel memory locations in the first     megabyte (and bypass slab-allocation access     restrictions) via an application that opens the     /dev/mem file, related to arch/x86/mm/init.c and     drivers/char/mem.c.(CVE-2017-7889)

  - The code in the drivers/scsi/libsas/sas_scsi_host.c     file in the Linux kernel allow a physically proximate     attacker to cause a memory leak in the ATA command     queue and, thus, denial of service by triggering     certain failure conditions.(CVE-2018-10021)

  - A flaw was found in the Linux kernel's client-side     implementation of the cifs protocol. This flaw allows     an attacker controlling the server to kernel panic a     client which has the CIFS server     mounted.(CVE-2018-1066)

  - A flaw was found in the alarm_timer_nsleep() function     in kernel/time/alarmtimer.c in the Linux kernel. The     ktime_add_safe() function is not used and an integer     overflow can happen causing an alarm not to fire or     possibly a denial-of-service if using a large relative     timeout.(CVE-2018-13053)

  - An issue was discovered in the XFS filesystem in     fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel. A     NULL pointer dereference may occur for a corrupted xfs     image after xfs_da_shrink_inode() is called with a NULL     bp. This can lead to a system crash and a denial of     service.(CVE-2018-13094)

  - A flaw was found in the Linux Kernel in the     ucma_leave_multicast() function in     drivers/infiniband/core/ucma.c which allows access to a     certain data structure after freeing it in     ucma_process_join(). This allows an attacker to cause a     use-after-free bug and to induce kernel memory     corruption, leading to a system crash or other     unspecified impact. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2018-14734)

  - A race condition in the store_int_with_restart()     function in arch/x86/kernel/cpu/mcheck/mce.c in the     Linux kernel allows local users to cause a denial of     service (panic) by leveraging root access to write to     the check_interval file in a     /sys/devices/system/machinecheck/machinecheck (cpu     number) directory.(CVE-2018-7995)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - systemd: Out-of-bounds heap write in systemd-networkd     dhcpv6 option handling (CVE-2018-15688)

  - systemd: stack overflow when calling syslog from a     command with long cmdline (CVE-2018-16864)

  - systemd: stack overflow when receiving many journald     entries (CVE-2018-16865)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the screen package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The MScrollV function in ansi.c in GNU screen 4.3.1 and     earlier does not properly limit recursion, which allows     remote attackers to cause a denial of service (stack     consumption) via an escape sequence with a large repeat     count value.(CVE-2015-6806)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the qt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in Qt before 5.11.3. A     malformed GIF image causes a NULL pointer dereference     in QGifHandler resulting in a segmentation     fault.(CVE-2018-19870)

  - An issue was discovered in Qt before 5.11.3.
    QBmpHandler has a buffer overflow via BMP     data.(CVE-2018-19873)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the PyYAML package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In PyYAML before 4.1, the yaml.load() API could execute     arbitrary code. In other words, yaml.safe_load is not     used.(CVE-2017-18342)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - python: DOS via regular expression backtracking in     difflib.IS_LINE_JUNK method in difflib (CVE-2018-1061)

  - python: DOS via regular expression catastrophic     backtracking in apop() method in pop3lib     (CVE-2018-1060)

  - python: Missing salt initialization in _elementtree.c     module(CVE-2018-14647)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the poppler packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - poppler: heap-based buffer over-read in XRef::getEntry     in XRef.cc(CVE-2019-7310)

  - poppler: out of bounds read in pdfunite     (CVE-2018-13988)

  - poppler: Infinite recursion in     fofi/FoFiType1C.cc:FoFiType1C::cvtGlyph() function     allows denial of service (CVE-2017-18267)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - ntp: Stack-based buffer overflow in ntpq and ntpdc     allows denial of service or code execution     (CVE-2018-12327)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libxslt packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In libxslt 1.1.29 and earlier, the EXSLT math.random     function was not initialized with a random seed during     startup, which could cause usage of this function to     produce predictable outputs.(CVE-2015-9019)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libvncserver package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - libvncserver: Heap out-of-bounds write in rfbserver.c     in rfbProcessFileTransferReadBuffer() allows for     potential code execution (CVE-2018-15127)

  - LibVNC before commit     7b1ef0ffc4815cab9a96c7278394152bdc89dc4d contains heap     out-of-bound write vulnerability inside structure in     VNC client code that can result remote code     execution(CVE-2018-20020)

  - LibVNC before commit     ca2a5ac02fbbadd0a21fabba779c1ea69173d10b contains heap     use-after-free vulnerability in server code of file     transfer extension that can result remote code     execution.(CVE-2018-6307)

  - LibVNC before commit     73cb96fec028a576a5a24417b57723b55854ad7b contains heap     use-after-free vulnerability in server code of file     transfer extension that can result remote code     execution(CVE-2018-15126)

  - LibVNC before commit     a83439b9fbe0f03c48eb94ed05729cb016f8b72f contains     multiple heap out-of-bound write vulnerabilities in VNC     client code that can result remote code     execution(CVE-2018-20019)

  - LibVNC before 2f5b2ad1c6c99b1ac6482c95844a84d66bb52838     contains multiple weaknesses CWE-665: Improper     Initialization vulnerability in VNC client code that     allows attacker to read stack memory and can be abuse     for information disclosure. Combined with another     vulnerability, it can be used to leak stack memory     layout and in bypassing ASLR(CVE-2018-20022)

  - LibVNC before commit     4a21bbd097ef7c44bb000c3bd0907f96a10e4ce7 contains null     pointer dereference in VNC client code that can result     DoS.(CVE-2018-20024)

  - LibVNC before 0.9.12 contains multiple heap     out-of-bounds write vulnerabilities in     libvncclient/rfbproto.c. The fix for CVE-2018-20019 was     incomplete.(CVE-2018-20748)

  - LibVNC before 0.9.12 contains a heap out-of-bounds     write vulnerability in libvncserver/rfbserver.c. The     fix for CVE-2018-15127 was incomplete.(CVE-2018-20749)

  - LibVNC through 0.9.12 contains a heap out-of-bounds     write vulnerability in libvncserver/rfbserver.c. The     fix for CVE-2018-15127 was incomplete.(CVE-2018-20750)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An integer overflow in the implementation of the     posix_memalign in memalign functions in the GNU C     Library (aka glibc or libc6) 2.26 and earlier could     cause these functions to return a pointer to a heap     area that is too small, potentially leading to heap     corruption.(CVE-2018-6485)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ghostscript: Incorrect 'restoration of privilege'     checking when running out of stack during exception     handling (CVE-2018-16802)

  - ghostscript: User-writable error exception table     (CVE-2018-17183)

  - ghostscript: Saved execution stacks can leak operator     arrays (incomplete fix for CVE-2018-17183)     (CVE-2018-17961)

  - ghostscript: Saved execution stacks can leak operator     arrays (CVE-2018-18073)

  - ghostscript: 1Policy operator allows a sandbox     protection bypass (CVE-2018-18284)

  - ghostscript: Type confusion in setpattern (700141)     (CVE-2018-19134)

  - ghostscript: Improperly implemented security check in     zsetdevice function in psi/zdevice.c (CVE-2018-19409)

  - ghostscript: Uninitialized memory access in the     aesdecode operator (699665) (CVE-2018-15911)

  - ghostscript: incomplete fix for CVE-2018-16509     (CVE-2018-16863)

  - ghostscript: incorrect access checking in temp file     handling to disclose contents of files (699658)     (CVE-2018-16539)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the fuse packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - fuse: bypass of the 'user_allow_other' restriction when     SELinux is active (CVE-2018-10906)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - curl before version 7.61.1 is vulnerable to a buffer     overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the     length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap.
    The length value is then subsequently used to iterate     over the password and generate output into the     allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer     overflow when the password length exceeds 2GB (2^31     bytes).(CVE-2018-14618)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the 389-ds-base packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - 389-ds-base: ldapsearch with server side sort allows     users to cause a crash (CVE-2018-10935)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - systemd: Out-of-bounds heap write in systemd-networkd     dhcpv6 option handling (CVE-2018-15688)

  - systemd: stack overflow when calling syslog from a     command with long cmdline (CVE-2018-16864)

  - systemd: stack overflow when receiving many journald     entries (CVE-2018-16865)

  - systemd: Assertion failure when PID 1 receives a     zero-length message over notify socket(CVE-2016-7795)

  - systemd: Unsafe handling of hard links allowing     privilege escalation(CVE-2017-18078)

  - systemd: Out-of-bounds write in systemd-resolved due to     allocating too small buffer in     dns_packet_new(CVE-2017-9445)

  - systemd: memory leak in journald-server.c introduced by     fix for CVE-2018-16864 (CVE-2019-3815)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A Cross-Site Scripting vulnerability has been     discovered in squid in the way X.509 certificates     fields are displayed in some error pages. An attacker     who can control the certificate of the origin content     server may use this flaw to inject scripting code in     the squid generated page, which is executed on the     client's browser.(CVE-2018-19131)

  - A memory leak was discovered in the way Squid handles     SNMP denied queries. A remote attacker may use this     flaw to exhaust the resources on the server     machine.(CVE-2018-19132)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the rpm packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was found that rpm uses temporary files with     predictable names when installing an RPM. An attacker     with ability to write in a directory where files will     be installed could create symbolic links to an     arbitrary location and modify content, and possibly     permissions to arbitrary files, which could be used for     denial of service or possibly privilege     escalation.(CVE-2017-7501)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Perl before 5.26.3 and 5.28.x before 5.28.1 has a     buffer overflow via a crafted regular expression that     triggers invalid write operations.(CVE-2018-18311)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Severity
122770	EulerOS Virtualization 2.5.2 : perl (EulerOS-SA-2019-1078)	Medium
122710	EulerOS Virtualization 2.5.2 : ghostscript (EulerOS-SA-2019-1088)	Medium
122709	EulerOS Virtualization 2.5.2 : ghostscript (EulerOS-SA-2019-1087)	High
122708	EulerOS Virtualization 2.5.2 : glibc (EulerOS-SA-2019-1086)	Medium
122707	EulerOS Virtualization 2.5.2 : wget (EulerOS-SA-2019-1085)	Medium
122706	EulerOS Virtualization 2.5.2 : openssl (EulerOS-SA-2019-1084)	Medium
122705	EulerOS Virtualization 2.5.2 : curl (EulerOS-SA-2019-1083)	Medium
122704	EulerOS Virtualization 2.5.2 : libtasn1 (EulerOS-SA-2019-1082)	Medium
122703	EulerOS Virtualization 2.5.2 : bind (EulerOS-SA-2019-1081)	Medium
122702	EulerOS Virtualization 2.5.2 : yum-utils (EulerOS-SA-2019-1080)	High
122701	EulerOS Virtualization 2.5.2 : libjpeg-turbo (EulerOS-SA-2019-1079)	Medium
122700	EulerOS Virtualization 2.5.2 : gnupg2 (EulerOS-SA-2019-1077)	Medium
122699	EulerOS 2.0 SP5 : kernel (EulerOS-SA-2019-1076)	High
122698	EulerOS 2.0 SP5 : spice (EulerOS-SA-2019-1075)	Medium
122697	EulerOS 2.0 SP5 : docker-engine (EulerOS-SA-2019-1074)	High
122696	EulerOS 2.0 SP5 : rsyslog (EulerOS-SA-2019-1073)	Medium
122695	EulerOS 2.0 SP5 : python (EulerOS-SA-2019-1072)	Medium
122694	EulerOS 2.0 SP5 : poppler (EulerOS-SA-2019-1071)	Medium
122693	EulerOS 2.0 SP5 : polkit (EulerOS-SA-2019-1070)	Medium
122692	EulerOS 2.0 SP5 : php (EulerOS-SA-2019-1069)	Medium
122691	EulerOS 2.0 SP5 : libvncserver (EulerOS-SA-2019-1068)	High
122690	EulerOS 2.0 SP5 : libarchive (EulerOS-SA-2019-1067)	Medium
122689	EulerOS 2.0 SP5 : irssi (EulerOS-SA-2019-1066)	High
122688	EulerOS 2.0 SP5 : ghostscript (EulerOS-SA-2019-1065)	Medium
122687	EulerOS 2.0 SP5 : gd (EulerOS-SA-2019-1064)	High
122459	EulerOS Virtualization 2.5.2 : systemd (EulerOS-SA-2019-1063)	Medium
122414	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2019-1062)	High
122388	EulerOS 2.0 SP2 : docker-engine (EulerOS-SA-2019-1061)	High
122387	EulerOS 2.0 SP2 : systemd (EulerOS-SA-2019-1060)	High
122386	EulerOS 2.0 SP2 : screen (EulerOS-SA-2019-1059)	Medium
122385	EulerOS 2.0 SP2 : rsyslog (EulerOS-SA-2019-1058)	Medium
122384	EulerOS 2.0 SP2 : qt (EulerOS-SA-2019-1057)	High
122383	EulerOS 2.0 SP2 : PyYAML (EulerOS-SA-2019-1056)	High
122382	EulerOS 2.0 SP2 : python (EulerOS-SA-2019-1055)	Medium
122381	EulerOS 2.0 SP2 : poppler (EulerOS-SA-2019-1054)	Medium
122380	EulerOS 2.0 SP2 : ntp (EulerOS-SA-2019-1053)	High
122379	EulerOS 2.0 SP2 : libxslt (EulerOS-SA-2019-1052)	Medium
122378	EulerOS 2.0 SP2 : libvncserver (EulerOS-SA-2019-1051)	High
122377	EulerOS 2.0 SP2 : glibc (EulerOS-SA-2019-1050)	High
122376	EulerOS 2.0 SP2 : ghostscript (EulerOS-SA-2019-1049)	High
122375	EulerOS 2.0 SP2 : fuse (EulerOS-SA-2019-1048)	Medium
122374	EulerOS 2.0 SP2 : curl (EulerOS-SA-2019-1047)	Critical
122373	EulerOS 2.0 SP2 : 389-ds-base (EulerOS-SA-2019-1046)	Medium
122218	EulerOS 2.0 SP5 : systemd (EulerOS-SA-2019-1045)	High
122217	EulerOS 2.0 SP3 : squid (EulerOS-SA-2019-1044)	Medium
122216	EulerOS 2.0 SP3 : rpm (EulerOS-SA-2019-1043)	Medium
122215	EulerOS 2.0 SP5 : qt (EulerOS-SA-2019-1042)	High
122214	EulerOS 2.0 SP5 : PyYAML (EulerOS-SA-2019-1041)	High
122213	EulerOS 2.0 SP3 : PyYAML (EulerOS-SA-2019-1040)	High
122212	EulerOS 2.0 SP5 : perl (EulerOS-SA-2019-1039)	High

Huawei Local Security Checks Family for Nessus