According to the versions of the glib2 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in GNOME GLib before 2.66.8.
    When g_file_replace() is used with     G_FILE_CREATE_REPLACE_DESTINATION to replace a path     that is a dangling symlink, it incorrectly also creates     the target of the symlink as an empty file, which could     conceivably have security relevance if the symlink is     attacker-controlled. (If the path is a symlink to a     file that already exists, then the contents of that     file correctly remain unchanged.)(CVE-2021-28153)

  - An issue was discovered in GNOME GLib before 2.66.7 and     2.67.x before 2.67.4. If g_byte_array_new_take() was     called with a buffer of 4GB or more on a 64-bit     platform, the length would be truncated modulo 2**32,     causing unintended length truncation.(CVE-2021-27218)

  - An issue was discovered in GNOME GLib before 2.66.6 and     2.67.x before 2.67.3. The function g_bytes_new has an     integer overflow on 64-bit platforms due to an implicit     cast from 64 bits to 32 bits. The overflow could     potentially lead to memory corruption.(CVE-2021-27219)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glib2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in GNOME GLib before 2.66.6 and     2.67.x before 2.67.3. The function g_bytes_new has an     integer overflow on 64-bit platforms due to an implicit     cast from 64 bits to 32 bits. The overflow could     potentially lead to memory corruption.(CVE-2021-27219)

  - An issue was discovered in GNOME GLib before 2.66.7 and     2.67.x before 2.67.4. If g_byte_array_new_take() was     called with a buffer of 4GB or more on a 64-bit     platform, the length would be truncated modulo 2**32,     causing unintended length truncation.(CVE-2021-27218)

  - An issue was discovered in GNOME GLib before 2.66.8.
    When g_file_replace() is used with     G_FILE_CREATE_REPLACE_DESTINATION to replace a path     that is a dangling symlink, it incorrectly also creates     the target of the symlink as an empty file, which could     conceivably have security relevance if the symlink is     attacker-controlled. (If the path is a symlink to a     file that already exists, then the contents of that     file correctly remain unchanged.)(CVE-2021-28153)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2467 advisory.

    GLib provides the core application building blocks for libraries and applications written in C. It     provides the core object system used in GNOME, the main loop implementation, and a large set of utility     functions for strings and common data structures.

    Security Fix(es):

    * glib: integer overflow in g_bytes_new function on 64-bit platforms due to an implicit cast from 64 bits     to 32 bits (CVE-2021-27219)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2203 advisory.

    GLib provides the core application building blocks for libraries and applications written in C. It     provides the core object system used in GNOME, the main loop implementation, and a large set of utility     functions for strings and common data structures.

    Security Fix(es):

    * glib: integer overflow in g_bytes_new function on 64-bit platforms due to an implicit cast from 64 bits     to 32 bits (CVE-2021-27219)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:4526 advisory.

  - An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take()     was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32,     causing unintended length truncation. (CVE-2021-27218)

  - An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has     an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow     could potentially lead to memory corruption. (CVE-2021-27219)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4526 advisory.

  - glib: integer overflow in g_byte_array_new_take function when called with a buffer of 4GB or more on a     64-bit platform (CVE-2021-27218)

  - glib: integer overflow in g_bytes_new function on 64-bit platforms due to an implicit cast from 64 bits to     32 bits (CVE-2021-27219)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the glib package has been released.

The version of AOS installed on the remote host is prior to 5.20.2. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.20.2 advisory.

  - A flaw was found in the Routing decision classifier in the Linux kernel's Traffic Control networking     subsystem in the way it handled changing of classification filters, leading to a use-after-free condition.
    This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3715)

  - Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP     transfer-encoding request header in some circumstances leading to the possibility to request smuggling     when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if     the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding;
    and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
    (CVE-2021-33037)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle     GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise     Edition. Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2021-2341)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Library). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2021-2369)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Hotspot). Supported versions that are affected are Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2021-2388)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
151180	EulerOS Virtualization for ARM 64 3.0.6.0 : glib2 (EulerOS-SA-2021-1999)	Nessus	Huawei Local Security Checks	6/30/2021	12/12/2023	medium
151228	EulerOS Virtualization 3.0.6.6 : glib2 (EulerOS-SA-2021-2030)	Nessus	Huawei Local Security Checks	7/1/2021	12/11/2023	medium
155784	RHEL 6 : glib2 (RHSA-2021:2467)	Nessus	Red Hat Local Security Checks	12/2/2021	11/7/2024	high
165127	RHEL 7 : glib2 (RHSA-2021:2203)	Nessus	Red Hat Local Security Checks	9/15/2022	11/7/2024	high
157727	AlmaLinux 8 : mingw-glib2 (ALSA-2021:4526)	Nessus	Alma Linux Local Security Checks	2/9/2022	11/10/2023	high
155053	CentOS 8 : mingw-glib2 (CESA-2021:4526)	Nessus	CentOS Local Security Checks	11/11/2021	11/24/2023	high
148023	Photon OS 4.0: Glib PHSA-2021-4.0-0001	Nessus	PhotonOS Local Security Checks	3/24/2021	8/22/2025	high
164568	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.20.2)	Nessus	Misc.	9/1/2022	2/17/2025	high

Detections

Analytics

Plugins Search

medium

medium

high

high

high

high

high

high