The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-2064:04 advisory.

    The glibc package contains standard libraries which are used by     multiple programs on the system. In order to save disk space and     memory, as well as to make upgrading easier, common system code is     kept in one place and shared between programs. This particular package     contains the most important sets of shared libraries: the standard C     library and the standard math library. Without these two libraries, a     Linux system will not function.
    CVE-2014-9761     Multiple stack-based buffer overflows in the GNU C Library (aka glibc     or libc6) before 2.23 allow context-dependent attackers to cause a     denial of service (application crash) or possibly execute arbitrary     code via a long argument to the (1) nan, (2) nanf, or (3) nanl     function.
    CVE-2015-8776     The strftime function in the GNU C Library (aka glibc or libc6) before     2.23 allows context-dependent attackers to cause a denial of service     (application crash) or possibly obtain sensitive information via an     out-of-range time value.
    CVE-2015-8777     The process_envvars function in elf/rtld.c in the GNU C Library (aka     glibc or libc6) before 2.23 allows local users to bypass a     pointer-guarding protection mechanism via a zero value of the     LD_POINTER_GUARD environment variable.
    CVE-2015-8778     Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23     allows context-dependent attackers to cause a denial of service     (application crash) or possibly execute arbitrary code via the size     argument to the __hcreate_r function, which triggers out-of-bounds     heap-memory access.
    CVE-2015-8779     Stack-based buffer overflow in the catopen function in the GNU C     Library (aka glibc or libc6) before 2.23 allows context-dependent     attackers to cause a denial of service (application crash) or possibly     execute arbitrary code via a long catalog name.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-1373:01 advisory.

    The glibc package contains standard libraries which are used by     multiple programs on the system. In order to save disk space and     memory, as well as to make upgrading easier, common system code is     kept in one place and shared between programs. This particular package     contains the most important sets of shared libraries: the standard C     library and the standard math library. Without these two libraries, a     Linux system will not function.
    Security issues fixed with this release:
    CVE-2014-9761     Multiple stack-based buffer overflows in the GNU C Library (aka glibc     or libc6) before 2.23 allow context-dependent attackers to cause a     denial of service (application crash) or possibly execute arbitrary     code via a long argument to the (1) nan, (2) nanf, or (3) nanl     function.
    CVE-2015-8776     The strftime function in the GNU C Library (aka glibc or libc6) before     2.23 allows context-dependent attackers to cause a denial of service     (application crash) or possibly obtain sensitive information via an     out-of-range time value.
    CVE-2015-8778     Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23     allows context-dependent attackers to cause a denial of service     (application crash) or possibly execute arbitrary code via the size     argument to the __hcreate_r function, which triggers out-of-bounds     heap-memory access.
    CVE-2015-8779     Stack-based buffer overflow in the catopen function in the GNU C     Library (aka glibc or libc6) before 2.23 allows context-dependent     attackers to cause a denial of service (application crash) or possibly     execute arbitrary code via a long catalog name.
    Additional Changes:

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Update newmode size to fix a possible corruption

  - Fix AF_INET6 getaddrinfo with nscd (#1416496)

  - Update tests for struct sockaddr_storage changes     (#1338673)

  - Use FL_CLOEXEC in internal calls to fopen (#1012343).

  - Fix CVE-2015-8779 glibc: Unbounded stack allocation in     catopen function (#1358015).

  - Make padding in struct sockaddr_storage explicit     (#1338673)

  - Fix detection of Intel FMA hardware (#1384281).

  - Add support for, ur_IN, and wal_ET locales (#1101858).

  - Change malloc/tst-malloc-thread-exit.c to use fewer     threads and avoid timeout (#1318380).

  - df can fail on some systems (#1307029).

  - Log uname, cpuinfo, meminfo during build (#1307029).

  - Draw graphs for heap and stack only if MAXSIZE_HEAP and     MAXSIZE_STACK are non-zero (#1331304).

  - Avoid unneeded calls to __check_pf in getadddrinfo     (#1270950)

  - Fix CVE-2015-8778 glibc: Integer overflow in hcreate and     hcreate_r (#1358013).

  - Fix CVE-2015-8776 glibc: Segmentation fault caused by     passing out-of-range data to strftime (#1358011).

  - tzdata-update: Ignore umask setting (#1373646)

  - CVE-2014-9761: Fix unbounded stack allocation in nan*     (#1358014)

  - Avoid using uninitialized data in getaddrinfo (#1223095)

  - Update fix for CVE-2015-7547 (#1296029).

  - Create helper threads with enough stack for POSIX AIO     and timers (#1299319).

  - Fix CVE-2015-7547: getaddrinfo stack-based buffer     overflow (#1296029).

  - Update malloc free_list cyclic fix (#1264189).

  - Update tzdata-update changes (#1200555).

  - Avoid redundant shift character in iconv output at block     boundary (#1293914).

  - Clean up testsuite results when testing with newer     kernels (#1293464).

  - Do not rewrite /etc/localtime if it is a symbolic link.
    (#1200555)

  - Support long lines in /etc/hosts (#1020263).

  - Avoid aliasing warning in tst-rec-dlopen (#1291444)

  - Don't touch user-controlled stdio locks in forked child     (#1275384).

  - Increase the limit of shared libraries that can use     static TLS (#1198802).

  - Avoid PLT in libm for feupdateenv (#1186104).

  - Allow PLT entry in libc for _Unwind_Find_FDE on     s390/s390x (#1186104).

  - Provide /etc/gai.conf only in the glibc package.
    (#1223818)

  - Change first day of the week to Monday for the ca_ES     locale. (#1011900)

  - Update BIG5-HKSCS charmap to HKSCS-2008. (#1211748)

  - Rename Oriya locale to Odia. (#1091334)

  - Avoid hang in gethostbyname_r due to missing mutex     unlocking (#1192621)

  - Avoid ld.so crash when audit modules provide path     (#1211098)

  - Suppress expected backtrace in tst-malloc-backtrace     (#1276633)

  - Avoid PLT for memmem (#1186104).

  - Fix up a missing dependency in the Makefile (#1219627).

  - Reduce lock contention in __tz_convert (#1244585).

  - Prevent the malloc arena free list from becoming cyclic     (#1264189)

  - Remove legacy IA64 support (#1246145).

  - Check for NULL arena pointer in _int_pvalloc (#1246656).

  - Don't change no_dyn_threshold on mallopt failure     (#1246660).

  - Unlock main arena after allocation in calloc (#1245731).

  - Enable robust malloc change again (#1245731).

  - Fix perturbing in malloc on free and simply perturb_byte     (#1245731).

  - Don't fall back to mmap prematurely (#1245731).

  - The malloc deadlock avoidance support has been     temporarily removed since it triggers deadlocks in     certain applications (#1243824).

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2985-1 advisory.

    Martin Carpenter discovered that pt_chown in the GNU C Library did not properly check permissions for tty     files. A local attacker could use this to gain administrative privileges or expose sensitive information.
    (CVE-2013-2207, CVE-2016-2856)

    Robin Hack discovered that the Name Service Switch (NSS) implementation in the GNU C Library did not     properly manage its file descriptors. An attacker could use this to cause a denial of service (infinite     loop). (CVE-2014-8121)

    Joseph Myers discovered that the GNU C Library did not properly handle long arguments to functions     returning a representation of Not a Number (NaN). An attacker could use this to cause a denial of service     (stack exhaustion leading to an application crash) or possibly execute arbitrary code. (CVE-2014-9761)

    Arjun Shankar discovered that in certain situations the nss_dns code in the GNU C Library did not properly     account buffer sizes when passed an unaligned buffer. An attacker could use this to cause a denial of     service or possibly execute arbitrary code. (CVE-2015-1781)

    Sumit Bose and Lukas Slebodnik discovered that the Name Service Switch (NSS) implementation in the GNU C     Library did not handle long lines in the files databases correctly. A local attacker could use this to     cause a denial of service (application crash) or possibly execute arbitrary code. (CVE-2015-5277)

    Adam Nielsen discovered that the strftime function in the GNU C Library did not properly handle out-of-     range argument data. An attacker could use this to cause a denial of service (application crash) or     possibly expose sensitive information. (CVE-2015-8776)

    Hector Marco and Ismael Ripoll discovered that the GNU C Library allowed the pointer-guarding protection     mechanism to be disabled by honoring the LD_POINTER_GUARD environment variable across privilege     boundaries. A local attacker could use this to exploit an existing vulnerability more easily.
    (CVE-2015-8777)

    Szabolcs Nagy discovered that the hcreate functions in the GNU C Library did not properly check its size     argument, leading to an integer overflow. An attacker could use to cause a denial of service (application     crash) or possibly execute arbitrary code. (CVE-2015-8778)

    Maksymilian Arciemowicz discovered a stack-based buffer overflow in the catopen function in the GNU C     Library when handling long catalog names. An attacker could use this to cause a denial of service     (application crash) or possibly execute arbitrary code. (CVE-2015-8779)

    Florian Weimer discovered that the getnetbyname implementation in the GNU C Library did not properly     handle long names passed as arguments. An attacker could use to cause a denial of service (stack     exhaustion leading to an application crash). (CVE-2016-3075)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for glibc fixes the following security issues :

  - CVE-2015-7547: A stack-based buffer overflow in     getaddrinfo allowed remote attackers to cause a crash or     execute arbitrary code via crafted and timed DNS     responses (bsc#961721)

  - CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD     environment variable allowed local attackers to bypass     the pointer guarding protection of the dynamic loader on     set-user-ID and set-group-ID programs (bsc#950944)

  - CVE-2015-8776: Out-of-range time values passed to the     strftime function may cause it to crash, leading to a     denial of service, or potentially disclosure information     (bsc#962736)

  - CVE-2015-8778: Integer overflow in hcreate and hcreate_r     could have caused an out-of-bound memory access. leading     to application crashes or, potentially, arbitrary code     execution (bsc#962737)

  - CVE-2014-9761: A stack overflow (unbounded alloca) could     have caused applications which process long strings with     the nan function to crash or, potentially, execute     arbitrary code. (bsc#962738)

  - CVE-2015-8779: A stack overflow (unbounded alloca) in     the catopen function could have caused applications     which pass long strings to the catopen function to crash     or, potentially execute arbitrary code. (bsc#962739)

The following non-security bugs were fixed :

  - bsc#955647: Resource leak in resolver

  - bsc#956716: Don't do lock elision on an error checking     mutex

  - bsc#958315: Reinitialize dl_load_write_lock on fork

This update was imported from the SUSE:SLE-12-SP1:Update update project.

This update for glibc fixes the following issues :

  - errorcheck-mutex-no-elision.patch: Don't do lock elision     on an error checking mutex (boo#956716, BZ #17514)

  - reinitialize-dl_load_write_lock.patch: Reinitialize     dl_load_write_lock on fork (boo#958315, BZ #19282)

  - send-dg-buffer-overflow.patch: Fix getaddrinfo     stack-based buffer overflow (CVE-2015-7547, boo#961721,     BZ #18665)

  - strftime-range-check.patch: Add range check on time     fields (CVE-2015-8776, boo#962736, BZ #18985)

  - hcreate-overflow-check.patch: Handle overflow in hcreate     (CVE-2015-8778, boo#962737, BZ #18240)

  - refactor-nan-parsing.patch: Refactor strtod parsing of     NaN payloads (CVE-2014-9761, boo#962738, BZ #16962)

  - catopen-unbound-alloca.patch: Fix unbound alloca in     catopen (CVE-2015-8779, boo#962739, BZ #17905)

ID	Name	Product	Family	Published	Updated	Severity
289865	MiracleLinux 7 : glibc-2.17-196.el7 (AXSA:2017-2064:04)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	critical
289152	MiracleLinux 4 : glibc-2.12-1.209.AXS4 (AXSA:2017-1373:01)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	critical
99078	OracleVM 3.3 / 3.4 : glibc (OVMSA-2017-0051)	Nessus	OracleVM Local Security Checks	3/30/2017	1/14/2026	critical
91334	Ubuntu 14.04 LTS : GNU C Library vulnerabilities (USN-2985-1)	Nessus	Ubuntu Local Security Checks	5/26/2016	8/27/2024	critical
88829	openSUSE Security Update : glibc (openSUSE-2016-224)	Nessus	SuSE Local Security Checks	2/18/2016	6/18/2024	critical
88855	openSUSE Security Update : glibc (openSUSE-2016-233)	Nessus	SuSE Local Security Checks	2/19/2016	6/18/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical