The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some     previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed     malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how     the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.
    (CVE-2025-8058)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02964-1 advisory.

    - CVE-2025-8058: Fixed double-free after allocation failure in regcomp. (bsc#1246965)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the glibc package has been released.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:12980 advisory.

    * glibc: Double free in glibc (CVE-2025-8058)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to AHV-10.3.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-10.3.1 advisory.

  - There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could     exceed the number of columns available. This could lead to a memory corruption issue. We recommend     upgrading to version 3.50.2 or above. (CVE-2025-6965)

  - LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize),     affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data     corruption.) NOTE: the vendor states only a few specific / uncommon usages of the API are at risk.
    (CVE-2019-17543)

  - A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under     certain circumstances when the XML schematron has the <sch:name path=.../> schema elements. This flaw     allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the     program's crash using libxml or other possible undefined behaviors. (CVE-2025-49794)

  - A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can     trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that     can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to     sensitive data being corrupted in memory. (CVE-2025-49796)

  - A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations     can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of     service when processing crafted input. (CVE-2025-6021)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of glibc installed on the remote host is prior to 2.26-64. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3040 advisory.

    The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some     previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed     malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how     the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.
    (CVE-2025-8058)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2025:0138 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-0395:
    When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough     space for the assertion failure message string and size information, which may lead to a buffer overflow     if the message string size aligns to page size.

    CVE-2025-4802:
    Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38     allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries     that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as     getaddrinfo).

    CVE-2025-8058:
    The regcomp function in the GNU C library version from 2.4 to 2.41 is     subject to a double free if some previous allocation fails. It can be     accomplished either by a malloc failure or by using an interposed malloc     that injects random malloc failures. The double free can allow buffer     manipulation depending of how the regex is constructed. This issue     affects all architectures and ABIs supported by the GNU C library.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
249696	Linux Distros Unpatched Vulnerability : CVE-2025-8058	Nessus	Misc.	8/15/2025	9/25/2025	medium
255215	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : glibc (SUSE-SU-2025:02964-1)	Nessus	SuSE Local Security Checks	8/26/2025	8/26/2025	medium
260439	Photon OS 5.0: Glibc PHSA-2025-5.0-0609	Nessus	PhotonOS Local Security Checks	9/2/2025	9/2/2025	medium
261715	RockyLinux 8 : glibc (RLSA-2025:12980)	Nessus	Rocky Linux Local Security Checks	9/8/2025	9/8/2025	medium
269975	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.3.1)	Nessus	Misc.	10/10/2025	10/10/2025	high
271762	Amazon Linux 2 : glibc, --advisory ALAS2-2025-3040 (ALAS-2025-3040)	Nessus	Amazon Linux Local Security Checks	10/28/2025	10/28/2025	medium
252263	Alibaba Cloud Linux 3 : 0138: glibc (ALINUX3-SA-2025:0138)	Nessus	Alibaba Cloud Linux Local Security Checks	8/19/2025	8/19/2025	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

high

medium

medium