The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5629 advisory.

    Orc is a library and set of tools for compiling and executing very simple programs that operate on arrays     of data.  The language is a generic assembly language that represents many of the features available in     SIMD architectures, including saturated addition and subtraction, and many arithmetic operations.

    Security Fix(es):

    * orc: Stack-based buffer overflow vulnerability in ORC (CVE-2024-40897)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5638 advisory.

    Orc is a library and set of tools for compiling and executing very simple programs that operate on arrays     of data.  The language is a generic assembly language that represents many of the features available in     SIMD architectures, including saturated addition and subtraction, and many arithmetic operations.

    Security Fix(es):

    * orc: Stack-based buffer overflow vulnerability in ORC (CVE-2024-40897)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of orc installed on the remote host is prior to 0.4.26-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2727 advisory.

    Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a     developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code     may be executed on the developer's build environment. (CVE-2024-40897)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0197 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2024-40897:
    Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a     developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code     may be executed on the developer's build environment. This may lead to compromise of developer machines or     CI build environments.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:6184 advisory.

    * orc: Stack-based buffer overflow vulnerability in ORC (CVE-2024-40897)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-728 advisory.

    Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a     developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code     may be executed on the developer's build environment. (CVE-2024-40897)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a     developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code     may be executed on the developer's build environment. This may lead to compromise of developer machines or     CI build environments. (CVE-2024-40897)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202505-05 (Orc: Arbitrary Code Execution)

    Please review the CVE identifier referenced below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
205878	RHEL 9 : orc (RHSA-2024:5629)	Nessus	Red Hat Local Security Checks	8/20/2024	11/8/2024	medium
205883	RHEL 9 : orc:0.4.31 (RHSA-2024:5638)	Nessus	Red Hat Local Security Checks	8/20/2024	4/8/2025	medium
213667	Amazon Linux 2 : orc (ALAS-2025-2727)	Nessus	Amazon Linux Local Security Checks	1/9/2025	1/9/2025	medium
236339	Alibaba Cloud Linux 3 : 0197: orc (ALINUX3-SA-2024:0197)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	medium
206608	AlmaLinux 9 : orc (ALSA-2024:6184)	Nessus	Alma Linux Local Security Checks	9/4/2024	9/4/2024	medium
208983	Amazon Linux 2023 : orc, orc-compiler, orc-devel (ALAS2023-2024-728)	Nessus	Amazon Linux Local Security Checks	10/14/2024	10/14/2024	medium
229319	Linux Distros Unpatched Vulnerability : CVE-2024-40897	Nessus	Misc.	3/5/2025	9/2/2026	medium
235725	GLSA-202505-05 : Orc: Arbitrary Code Execution	Nessus	Gentoo Local Security Checks	5/12/2025	5/12/2025	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium