The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8395 advisory.

    [3.1.3-23]
    - Resolves: RHEL-52004 - Slowness in rsync due to extra validation steps

    [3.1.3-22]
    - Resolves: RHEL-91519 - Improper Pointer Arithmetic in pcl

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:11048 advisory.

    The rsync utility enables the users to copy and synchronize files locally or across a network.
    Synchronization with rsync is fast because rsync only sends the differences in files over the network     instead of sending whole files. The rsync utility is also used as a mirroring tool.

    Security Fix(es):

    * zlib: Out-of-bounds pointer arithmetic in inftrees.c (CVE-2016-9840)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:13947 advisory.

    The rsync utility enables the users to copy and synchronize files locally or across a network.
    Synchronization with rsync is fast because rsync only sends the differences in files over the network     instead of sending whole files. The rsync utility is also used as a mirroring tool.

    Security Fix(es):

    * zlib: Out-of-bound pointer arithmetic in inftrees.c (CVE-2016-9840)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for zlib fixes the following issues :

  - Incompatible declarations for external linkage function     deflate (bnc#1003577)

  - CVE-2016-9842: Undefined Left Shift of Negative Number     (bnc#1003580)

  - CVE-2016-9840 CVE-2016-9841: Out-of-bounds pointer     arithmetic in inftrees.c (bnc#1003579)

  - CVE-2016-9843: Big-endian out-of-bounds pointer

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for zlib fixes the following issues :

  - CVE-2016-9843: Big-endian out-of-bounds pointer

  - CVE-2016-9842: Undefined Left Shift of Negative Number     (bsc#1003580) 

  - CVE-2016-9840 CVE-2016-9841: Out-of-bounds pointer     arithmetic in inftrees.c (bsc#1003579)

  - Incompatible declarations for external linkage function     deflate (bsc#1003577)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

According to the versions of the deltarpm package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - inftrees.h in zlib 1.2.2 allows remote attackers to cause a denial of service (application crash) via an     invalid file that causes a large dynamic tree to be produced. (CVE-2005-1849)

  - inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging     improper pointer arithmetic. (CVE-2016-9840)

  - inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging     improper pointer arithmetic. (CVE-2016-9841)

  - The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have     unspecified impact via vectors involving big-endian CRC calculation. (CVE-2016-9843)

  - zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many     distant matches. (CVE-2018-25032)

  - zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a     large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some     common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g.,     see the nodejs/node reference). (CVE-2022-37434)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the mariadb-connector-c package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging     improper pointer arithmetic. (CVE-2016-9840)

  - inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging     improper pointer arithmetic. (CVE-2016-9841)

  - The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have     unspecified impact via vectors involving left shifts of negative integers. (CVE-2016-9842)

  - The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have     unspecified impact via vectors involving big-endian CRC calculation. (CVE-2016-9843)

  - zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many     distant matches. (CVE-2018-25032)

  - zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a     large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some     common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g.,     see the nodejs/node reference). (CVE-2022-37434)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the deltarpm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - inftrees.h in zlib 1.2.2 allows remote attackers to cause a denial of service (application crash) via an     invalid file that causes a large dynamic tree to be produced. (CVE-2005-1849)

  - inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging     improper pointer arithmetic. (CVE-2016-9840)

  - inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging     improper pointer arithmetic. (CVE-2016-9841)

  - The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have     unspecified impact via vectors involving big-endian CRC calculation. (CVE-2016-9843)

  - zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many     distant matches. (CVE-2018-25032)

  - zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a     large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some     common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g.,     see the nodejs/node reference). (CVE-2022-37434)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6736-2 advisory.

    USN-6736-1 fixed vulnerabilities in klibc. This update provides the corresponding updates for Ubuntu 24.04     LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.103053. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.103053 advisory.

  - inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging     improper pointer arithmetic. (CVE-2016-9840)

  - xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result     prefixes. (CVE-2024-55549)

  - numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath     context node can be modified but never restored. This is related to xsltNumberFormatGetValue,     xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal. (CVE-2025-24855)

  - An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not     vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font     files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value     causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed     long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This     vulnerability may have been exploited in the wild. (CVE-2025-27363)

  - A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity     expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat     can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could     lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the     environment and library usage. (CVE-2024-8176)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
237712	Oracle Linux 8 : rsync (ELSA-2025-8395)	Nessus	Oracle Linux Local Security Checks	6/3/2025	6/3/2025	high
242102	RHEL 8 : rsync (RHSA-2025:11048)	Nessus	Red Hat Local Security Checks	7/15/2025	7/15/2025	high
251023	RHEL 8 : rsync (RHSA-2025:13947)	Nessus	Red Hat Local Security Checks	8/18/2025	8/18/2025	high
96077	SUSE SLES11 Security Update : zlib (SUSE-SU-2016:3209-1)	Nessus	SuSE Local Security Checks	12/22/2016	1/7/2026	critical
96376	openSUSE Security Update : zlib (openSUSE-2017-46)	Nessus	SuSE Local Security Checks	1/10/2017	1/6/2026	critical
167381	EulerOS 2.0 SP9 : deltarpm (EulerOS-SA-2022-2758)	Nessus	Huawei Local Security Checks	11/14/2022	10/4/2023	critical
167427	EulerOS 2.0 SP9 : mariadb-connector-c (EulerOS-SA-2022-2771)	Nessus	Huawei Local Security Checks	11/14/2022	10/4/2023	critical
169013	EulerOS 2.0 SP10 : deltarpm (EulerOS-SA-2022-2816)	Nessus	Huawei Local Security Checks	12/21/2022	9/12/2023	critical
197834	Ubuntu 24.04 LTS : klibc vulnerabilities (USN-6736-2)	Nessus	Ubuntu Local Security Checks	5/23/2024	10/29/2024	critical
253665	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.103053)	Nessus	Misc.	8/22/2025	8/22/2025	high

Detections

Analytics

Plugins Search

high

high

high

critical

critical

critical

critical

critical

critical

high