According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough     space for the assertion failure message string and size information, which may lead to a buffer overflow     if the message string size aligns to page size.(CVE-2025-0395)

Tenable has extracted the preceding description block directly from the EulerOS glibc security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0562-1 advisory.

    - CVE-2025-0395: Fix underallocation of abort_msg_s struct (bsc#1236282)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-4244 advisory.

    [2.34-125.0.1.8]
    - Forward-port Oracle patches for ol9-u5 (glibc-2.34-125.0.1.8)       Reviewed by: David Faust <david.faust@oracle.com>       Oracle history:

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3828 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: buffer overflow in the GNU C Library's assert() (CVE-2025-0395)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:4244 advisory.

    * glibc: buffer overflow in the GNU C Library's assert() (CVE-2025-0395)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-69207650a4 advisory.

    This update addresses two security vulnerabilities:
    * CVE-2025-0395: A buffer overflow may occur in the `assert` function with certain large program names and     `assert` expressions.
    * CVE-2025-0577: getrandom, arc4random can produce predictable randomness if a multi-threaded program     creates additional threads after fork.
    The following non-security bugs are fixed:
    * Compatibility with certain programs that call `free(environ)` is improved (however, deallocating     `environ` remains undefined in general).
    * Crashes in string functions on certain hypervisors that report L3 cache sizes above 4 GiB are avoided.
    * Poor performance of x86-64 string functions in certain cases.
    * Initialization of the restartable sequence area now follows recommended practices.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-988 advisory.

    In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to     emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state     reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states the bug     cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to     require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.
    (CVE-2021-43396)

    glibc: stack-based buffer overflow in netgroup cache (CVE-2024-33599)

    glibc: null pointer dereferences after failed netgroup cache insertion (CVE-2024-33600)

    glibc: netgroup cache may terminate daemon on memory allocation failure (CVE-2024-33601)

    glibc: netgroup cache assumes NSS callback uses in-buffer strings (CVE-2024-33602)

    When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough     space for the assertion failure message string and size information, which may lead to a buffer overflow     if the message string size aligns to page size. (CVE-2025-0395)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to AHV-10.0.1.2. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-10.0.1.2 advisory.

  - inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging     improper pointer arithmetic. (CVE-2016-9840)

  - xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result     prefixes. (CVE-2024-55549)

  - numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath     context node can be modified but never restored. This is related to xsltNumberFormatGetValue,     xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal. (CVE-2025-24855)

  - An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not     vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font     files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value     causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed     long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This     vulnerability may have been exploited in the wild. (CVE-2025-27363)

  - A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity     expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat     can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could     lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the     environment and library usage. (CVE-2024-8176)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	Name	Product	Family	Published	Updated	Severity
238387	EulerOS 2.0 SP11 : glibc (EulerOS-SA-2025-1656)	Nessus	Huawei Local Security Checks	6/12/2025	6/12/2025	high
216449	SUSE SLES15 Security Update : glibc (SUSE-SU-2025:0562-1)	Nessus	SuSE Local Security Checks	2/19/2025	2/19/2025	high
234916	Oracle Linux 9 : glibc (ELSA-2025-4244)	Nessus	Oracle Linux Local Security Checks	4/29/2025	9/11/2025	high
237850	RHEL 8 : glibc (RHSA-2025:3828)	Nessus	Red Hat Local Security Checks	6/5/2025	6/5/2025	high
238193	EulerOS 2.0 SP13 : glibc (EulerOS-SA-2025-1632)	Nessus	Huawei Local Security Checks	6/11/2025	6/11/2025	high
243172	RockyLinux 9 : glibc (RLSA-2025:4244)	Nessus	Rocky Linux Local Security Checks	7/30/2025	7/30/2025	high
214653	Fedora 40 : glibc (2025-69207650a4)	Nessus	Fedora Local Security Checks	1/27/2025	1/27/2025	high
237673	Amazon Linux 2023 : compat-libpthread-nonshared, glibc, glibc-all-langpacks (ALAS2023-2025-988)	Nessus	Amazon Linux Local Security Checks	6/2/2025	10/30/2025	high
253664	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.0.1.2)	Nessus	Misc.	8/22/2025	8/22/2025	high
504312	Siemens SIMATIC S7-1500 Incorrect Calculation of Buffer Size (CVE-2025-0395)	Tenable OT Security	Tenable.ot	11/13/2025	11/13/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high