The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0365 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-4016:
    Under some circumstances, this weakness allows a user who has access to run the ps utility on a     machine, the ability to write almost unlimited amounts of unfiltered data into the process heap.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0279 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-1017:
    An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context.

    CVE-2023-1018:
    An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0267 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-34750:
    Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache     Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers     correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect     infinite timeout which allowed connections to remain open which should have been closed.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from     9.0.0-M1 through 9.0.89.

    Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2022:0227 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2020-16301:
      A buffer overflow vulnerability in okiibm_print_page1() in devices/gdevokii.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is     fixed in v9.51.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0225 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-2961:
    An out-of-bounds write flaw was found in the ISO-2022-CN-EXT plugin for glibc's iconv library. When     converting from UCS4 charset, adding certain escape charterers is required to indicate where the charset     was changed to the library. During this process, iconv improperly checks the boundaries of internal     buffers, leading to a buffer overflow, which allows writing up to 3 bytes outside the desired memory     location. This issue may allow an attacker to craft a malicious characters sequence that will trigger the     out-of-bounds write and perform remote code execution, presenting a high impact to the Integrity,     Confidentiality, and Availability triad.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0434 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2024-5953:
    A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an     authenticated user to cause a server denial of service while attempting to log in with a user with a     malformed hash in their password.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0309 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-55549:
    xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result     prefixes.

    CVE-2025-24855:
    numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath     context node can be modified but never restored. This is related to xsltNumberFormatGetValue,     xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0323 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-35235:
    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In     versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a     symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument,     providing world-writable access to the target. Given that cupsd is often running as root, this can result     in the change of permission of any user or system files to be world writable. Given the aforementioned     Ubuntu AppArmor context, on such systems this vulnerability is limited to those files modifiable by the     cupsd process. In that specific case it was found to be possible to turn the configuration of the Listen     argument into full control over the cupsd.conf and cups-files.conf configuration files. By later setting     the User and Group arguments in cups-files.conf, and printing with a printer configured by PPD with a     FoomaticRIPCommandLine argument, arbitrary user and group (not root) command execution could be achieved,     which can further be used on Ubuntu systems to achieve full root command execution. Commit     ff1f8a623e090dee8a8aadf12a6a4b25efac143d contains a patch for the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2022:0157 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2022-31625:
    A vulnerability was found in PHP due to an uninitialized array in pg_query_params() function. When using     the Postgres database extension, supplying invalid parameters to the parameterized query may lead to PHP     attempting to free memory, using uninitialized data as pointers. This flaw allows a remote attacker with     the ability to control query parameters to execute arbitrary code on the system or may cause a denial of     service.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0140 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2018-19661:
      An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2ulaw_array     in ulaw.c that will lead to a denial of service.
      CVE-2018-19662:
      An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2alaw_array     in alaw.c that will lead to a denial of service.
      CVE-2018-13139:
      A stack-based buffer overflow in psf_memset in common.c in libsndfile 1.0.28 allows remote attackers to     cause a denial of service (application crash) or possibly have unspecified other impact via a crafted     audio file. The vulnerability can be triggered by the executable sndfile-deinterleave.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0269 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2025-27363:
    An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not     vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font     files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value     causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed     long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This     vulnerability may have been exploited in the wild.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:1084 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-10041:
    A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can     trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs,     the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result     in leaked passwords, such as those found in /etc/shadow while performing authentications.

    CVE-2024-10963:
    A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as     hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname,     gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who     can access certain services or terminals.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0487 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-5206:
    A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in     versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from     the unexpected storage of all tokens present in the training data within the `stop_words_` attribute,     rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior     leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain     tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this     vulnerability varies based on the nature of the data being processed by the vectorizer.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0036 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-57823:
    In Raptor RDF Syntax Library through 2.0.16, there is an integer underflow when normalizing a URI with the     turtle parser in raptor_uri_normalize_path().

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0222 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2023-45288:
    A vulnerability was discovered with the implementation of the HTTP/2 protocol in the Go programming     language. There were insufficient limitations on the amount of CONTINUATION frames sent within a single     stream. An attacker could potentially exploit this to cause a Denial of Service (DoS) attack.

    CVE-2023-45289:
    A flaw was found in Go's net/http/cookiejar standard library package. When following an HTTP redirect to a     domain that is not a subdomain match or an exact match of the initial domain, an http.Client does not     forward sensitive headers such as Authorization or Cookie. For example, a redirect from foo.com to     www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously     crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.

    CVE-2023-45290:
    A flaw was discovered in Go's net/http standard library package. When parsing a multipart form (either     explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or     Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed     while reading a single form line. This issue permitted a maliciously crafted input containing very long     lines to cause allocation of arbitrarily large amounts of memory, potentially leading to a denial of     service.

    CVE-2024-24783:
    A flaw was found in Go's crypto/x509 standard library package. Verifying a certificate chain that contains     a certificate with an unknown public key algorithm will cause a Certificate.Verify to panic. This issue     affects all crypto/tls clients and servers that set Config.ClientAuth to VerifyClientCertIfGiven or     RequireAndVerifyClientCert.

    CVE-2024-24784:
    A flaw was found in Go's net/mail standard library package. The ParseAddressList function incorrectly     handles comments (text within parentheses) within display names. Since this is a misalignment with     conforming address parsers, it can result in different trust decisions made by programs using different     parsers.

    CVE-2024-24785:
    A flaw was found in Go's html/template standard library package. If errors returned from MarshalJSON     methods contain user-controlled data, they may be used to break the contextual auto-escaping behavior of     the html/template package, allowing subsequent actions to inject unexpected content into templates.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0923 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-28219:
    In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of     strncpy.

    CVE-2021-25293:
    An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0406 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-6345:
    A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote     code execution via its download functions. These functions, which are used to download packages from URLs     provided by users or retrieved from package index servers, are susceptible to code injection. If these     functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands     on the system. The issue is fixed in version 70.0.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0064 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-37732:
    Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c and /elf/elf.c, which     allows the attacker to cause a denial of service via a crafted file.

    CVE-2023-31975:
    yasm v1.3.0 was discovered to contain a memory leak via the function yasm_intnum_copy at     /libyasm/intnum.c.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0276 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-30346:
    Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1     requests.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0774 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-4317:
    A flaw was found in PostgreSQL. Missing authorization in the built-in views pg_stats_ext and     pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics     from CREATE STATISTICS commands of other users. The most common values may reveal column values the     eavesdropper could not otherwise read or results of functions they cannot execute.

    CVE-2024-7348:
    Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to     execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack     involves replacing another relation type with a view or foreign table. The attack requires waiting for     pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction.
    Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0611 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-5679:
    A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure     during recursive resolution, when both of these features are enabled.
    This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through     9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.

    CVE-2023-5517:
    A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when:

    - `nxdomain-redirect <domain>;` is configured, and
    - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative     NXDOMAIN response.
    This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19,     9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.

    CVE-2023-50868:
    The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations.

    CVE-2023-50387:
    Certain DNSSEC aspects of the DNS protocol (in RFC 4035 and related RFCs) allow remote attackers to cause     a denial of service (CPU consumption) via one or more DNSSEC responses when there is a zone with many     DNSKEY and RRSIG records, aka the KeyTrap issue. The protocol specification implies that an algorithm     must evaluate all combinations of DNSKEY and RRSIG records.

    CVE-2023-4408:
    The DNS message parsing code in `named` includes a section whose computational complexity is overly high.
    It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive     CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative     servers and recursive resolvers.
    This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19,     9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0283 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2022-23527:
      mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x     HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter     to the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs     that start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users     unable to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when     the destination matches a given regular expression with OIDCRedirectURLsAllowed.

      CVE-2023-28625:
      mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that     implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when     OIDCStripCookies is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting     in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an     availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using     OIDCStripCookies.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0578 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-21646:
    Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to     implement AMQP protocol communication.  When clients using this library receive a crafted binary type     data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code     execution.  This vulnerability has been patched in release 2024-01-01.

    CVE-2024-27099:
    The uAMQP is a C library for AMQP 1.0 communication to Azure Cloud Services. When processing an incorrect     `AMQP_VALUE` failed state, may cause a double free problem. This may cause a RCE. Update submodule with     commit 2ca42b6e4e098af2d17e487814a91d05f6ae4987.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0115 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:
      CVE-2023-24540:
      A flaw was found in golang, where not all valid JavaScript white-space characters were considered white     space. Due to this issue, templates containing white-space characters outside of the character set     \t\n\f\r\u0020\u2028\u2029 in JavaScript contexts that also contain actions may not be properly     sanitized during execution.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
238527	TencentOS Server 4: procps-ng (TSSA-2024:0365)	low
238526	TencentOS Server 4: libtpms (TSSA-2024:0279)	high
238525	TencentOS Server 4: tomcat (TSSA-2024:0267)	high
238524	TencentOS Server 3: ghostscript (TSSA-2022:0227)	medium
238523	TencentOS Server 3: glibc (TSSA-2024:0225)	high
238522	TencentOS Server 2: 389-ds-base (TSSA-2024:0434)	medium
238521	TencentOS Server 3: libxslt (TSSA-2025:0309)	high
238520	TencentOS Server 3: cups (TSSA-2024:0323)	medium
238519	TencentOS Server 3: php:7.4 (TSSA-2022:0157)	high
238518	TencentOS Server 3: libsndfile (TSSA-2023:0140)	high
238517	TencentOS Server 2: freetype (TSSA-2025:0269)	high
238516	TencentOS Server 3: pam (TSSA-2024:1084)	high
238515	TencentOS Server 4: python-scikit-learn (TSSA-2024:0487)	medium
238514	TencentOS Server 4: raptor2 (TSSA-2025:0036)	medium
238513	TencentOS Server 3: go-toolset:rhel8 (TSSA-2024:0222)	high
238512	TencentOS Server 4: python-pillow (TSSA-2024:0923)	high
238511	TencentOS Server 3: python3.11-setuptools (TSSA-2024:0406)	high
238510	TencentOS Server 4: yasm (TSSA-2025:0064)	medium
238509	TencentOS Server 4: varnish (TSSA-2025:0276)	medium
238508	TencentOS Server 3: postgresql:15 (TSSA-2024:0774)	high
238507	TencentOS Server 4: bind (TSSA-2024:0611)	high
238506	TencentOS Server 3: mod_auth_openidc:2.3 (TSSA-2023:0283)	medium
238505	TencentOS Server 4: python-uamqp (TSSA-2024:0578)	critical
238504	TencentOS Server 3: go-toolset (TSSA-2023:0115)	critical

Detections

Analytics

Tencent Local Security Checks Family for Nessus

low

high

high

medium

high

medium

high

medium

high

high

high

high

medium

medium

high

high

high

medium

medium

high

high

medium

critical

critical