The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported     versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2805)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of MariaDB installed on the remote host is prior to 5.5.65. It is, therefore, affected by multiple vulnerabilities as referenced in the 5.5.65 advisory.

  - Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are     affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client.
    Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL     Client accessible data. (CVE-2021-2007)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges).
    Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily     exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL     Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well     as unauthorized update, insert or delete access to some of MySQL Server accessible data. (CVE-2019-2739)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Pluggable Auth).
    Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily     exploitable vulnerability allows high privileged attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2737)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: XML). Supported     versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2740)

  - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported     versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2805)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for mariadb to version 10.2.29 fixes the following issues :

MariaDB was updated to 10.2.29 (bsc#1156669) 

Security issues fixed :

  - CVE-2019-2737: Fixed an issue where could lead a remote     attacker to cause denial of service 

  - CVE-2019-2938: Fixed an issue where could lead a remote     attacker to cause denial of service 

  - CVE-2019-2740: Fixed an issue where could lead a local     attacker to cause denial of service

  - CVE-2019-2805: Fixed an issue where could lead a local     attacker to cause denial of service

  - CVE-2019-2974: Fixed an issue where could lead a remote     attacker to cause denial of service

  - CVE-2019-2758: Fixed an issue where could lead a local     attacker to cause denial of service or data corruption

  - CVE-2019-2739: Fixed an issue where could lead a local     attacker to cause denial of service or data corruption

This update was imported from the SUSE:SLE-15:Update update project.

The version of MySQL running on the remote host is 5.7.x prior to 5.7.27. It is, therefore, affected by multiple vulnerabilities, including three of the top vulnerabilities below, as noted in the July 2019 Critical Patch Update advisory:

  - A stack-based buffer overflow vulnerability in the     'Server: Packaging (cURL)' subcomponent could allow an     unauthenticated attacker to gain complete control of an     affected instance of MySQL Server. (CVE-2019-3822)

  - A vulnerability in the 'Server: Parser' subcomponent.
    This is an easily exploitable vulnerability that allows     a low privileged attacker with network access via     multiple protocols to compromise the server. Successful     attacks involving this vulnerability can result in the     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS). (CVE-2019-2805)

  - A vulnerability in the 'Server: XML' subcomponent. This     is an easily exploitable vulnerability that allows a     low privileged attacker with network access via multiple     protocols to compromise a server.Successful attacks     involving this vulnerability can result in the     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS).
    (CVE-2019-2740)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2019_3708 advisory.

    * mysql: InnoDB unspecified vulnerability (CPU Jan 2019) (CVE-2019-2510)

    * mysql: Server: DDL unspecified vulnerability (CPU Jan 2019) (CVE-2019-2537)

    * mysql: Server: Replication unspecified vulnerability (CPU Apr 2019) (CVE-2019-2614)

    * mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2019) (CVE-2019-2627)

    * mysql: InnoDB unspecified vulnerability (CPU Apr 2019) (CVE-2019-2628)

    * mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2019) (CVE-2019-2737)

    * mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2019) (CVE-2019-2739)

    * mysql: Server: XML unspecified vulnerability (CPU Jul 2019) (CVE-2019-2740)

    * mysql: InnoDB unspecified vulnerability (CPU Jul 2019) (CVE-2019-2758)

    * mysql: Server: Parser unspecified vulnerability (CPU Jul 2019) (CVE-2019-2805)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4070-1 advisory.

    Multiple security issues were discovered in MySQL and this update includes a new upstream MySQL version to     fix these issues.

    Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.04 have been updated to MySQL 5.7.27.

    In addition to security fixes, the updated packages contain bug fixes, new features, and possibly     incompatible changes.

    Please see the following for more information:
    http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-27.html     https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4070-2 advisory.

    USN-4070-1 fixed multiple vulnerabilities in MySQL. This update provides the corresponding fixes for     CVE-2019-2737, CVE-2019-2739, CVE-2019-2740, CVE-2019-2805 in MariaDB 10.1.

    Ubuntu 18.04 LTS has been updated to MariaDB 10.1.41.

    In addition to security fixes, the updated package contain bug fixes, new features, and possibly     incompatible changes.

    Please see the following for more information: https://mariadb.com/kb/en/library/mariadb-10141-changelog/     https://mariadb.com/kb/en/library/mariadb-10141-release-notes/



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the mysql package has been released.

A stack-based buffer overflow vulnerability in the 'Server: Packaging (cURL)' subcomponent could allow an unauthenticated attacker to gain complete control of an affected instance of MySQL Server.
(CVE-2019-3822)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: XML). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). (CVE-2019-2740)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). (CVE-2019-2805)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3708 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    The following packages have been upgraded to a later upstream version: mariadb (10.3.17), galera     (25.3.26). (BZ#1701687, BZ#1711265, BZ#1741358)

    Security Fix(es):

    * mysql: InnoDB unspecified vulnerability (CPU Jan 2019) (CVE-2019-2510)

    * mysql: Server: DDL unspecified vulnerability (CPU Jan 2019) (CVE-2019-2537)

    * mysql: Server: Replication unspecified vulnerability (CPU Apr 2019) (CVE-2019-2614)

    * mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2019) (CVE-2019-2627)

    * mysql: InnoDB unspecified vulnerability (CPU Apr 2019) (CVE-2019-2628)

    * mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2019) (CVE-2019-2737)

    * mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2019) (CVE-2019-2739)

    * mysql: Server: XML unspecified vulnerability (CPU Jul 2019) (CVE-2019-2740)

    * mysql: InnoDB unspecified vulnerability (CPU Jul 2019) (CVE-2019-2758)

    * mysql: Server: Parser unspecified vulnerability (CPU Jul 2019) (CVE-2019-2805)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1100 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    The following packages have been upgraded to a later upstream version: mariadb (5.5.65). (BZ#1741357)

    Security Fix(es):

    * mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2019) (CVE-2019-2737)

    * mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2019) (CVE-2019-2739)

    * mysql: Server: XML unspecified vulnerability (CPU Jul 2019) (CVE-2019-2740)

    * mysql: Server: Parser unspecified vulnerability (CPU Jul 2019) (CVE-2019-2805)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.18. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.18 advisory.

  - When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to     Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP     connection. If such connections are available to an attacker, they can be exploited in ways that may be     surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped     with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected     (and recommended in the security guide) that this Connector would be disabled if not required. This     vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the     web application - processing any file in the web application as a JSP Further, if the web application     allowed file upload and stored those files within the web application (or the attacker was able to control     the content of the web application by some other means) then this, along with the ability to process a     file as a JSP, made remote code execution possible. It is important to note that mitigation is only     required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth     approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to     Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP     Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading     to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
    (CVE-2020-1938)

  - rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a     certain upper-bound check, leading to a buffer overflow. (CVE-2019-17666)

  - The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-     free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can     occur with FUSE requests. (CVE-2019-11487)

  - A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where,     the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error     occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by     the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction     mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism     to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that     host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.
    (CVE-2019-19338)

  - The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which     allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.
    (CVE-2015-8035)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
222896	Linux Distros Unpatched Vulnerability : CVE-2019-2805	Nessus	Misc.	3/4/2025	8/20/2025	medium
129357	MariaDB 5.5.0 < 5.5.65 Multiple Vulnerabilities	Nessus	Databases	9/26/2019	1/29/2026	medium
132385	openSUSE Security Update : mariadb (openSUSE-2019-2698)	Nessus	SuSE Local Security Checks	12/23/2019	12/27/2019	medium
126783	MySQL 5.7.x < 5.7.27 Multiple Vulnerabilities (Jul 2019 CPU)	Nessus	Databases	7/18/2019	5/9/2024	critical
354311	Rocky Linux 8 [CIQ] Security Update: Judy / Judy-debuginfo / Judy-debugsource / Judy-devel / asio-devel Multiple Vulnerabilities (crlsa-2019_3708)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/1/2026	medium
127041	Ubuntu 16.04 LTS / 18.04 LTS : MySQL vulnerabilities (USN-4070-1)	Nessus	Ubuntu Local Security Checks	7/25/2019	8/28/2024	medium
127886	Ubuntu 18.04 LTS : MariaDB vulnerabilities (USN-4070-2)	Nessus	Ubuntu Local Security Checks	8/14/2019	10/29/2024	medium
129103	Photon OS 3.0: Mysql PHSA-2019-3.0-0026	Nessus	PhotonOS Local Security Checks	9/23/2019	7/23/2024	high
129567	Amazon Linux AMI : mysql57 (ALAS-2019-1297)	Nessus	Amazon Linux Local Security Checks	10/4/2019	4/19/2024	critical
130575	RHEL 8 : mariadb:10.3 (RHSA-2019:3708)	Nessus	Red Hat Local Security Checks	11/6/2019	11/7/2024	medium
135043	RHEL 7 : mariadb (RHSA-2020:1100)	Nessus	Red Hat Local Security Checks	3/31/2020	11/7/2024	medium
164595	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.18)	Nessus	Misc.	9/1/2022	9/1/2025	critical

Detections

Analytics

Plugins Search

medium

medium

medium

critical

medium

medium

medium

high

critical

medium

medium

critical