The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3583 advisory.

  - libsolv: illegal address access in pool_whatprovides in src/pool.h (CVE-2018-20534)

  - libcomps: use after free when merging two objmrtrees (CVE-2019-3817)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-3583 advisory.

  - ** DISPUTED ** There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2     that will cause a denial of service. NOTE: third parties dispute this issue stating that the issue affects     the test suite and not the underlying library. It cannot be exploited in any real-world application.
    (CVE-2018-20534)

  - A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are     merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to     crash the application or execute malicious code. (CVE-2019-3817)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libcomps packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A use-after-free flaw has been discovered in libcomps     before version 0.1.10 in the way ObjMRTrees are merged.
    An attacker, who is able to make an application read a     crafted comps XML file, may be able to crash the     application or execute malicious code.(CVE-2019-3817)

  - libseccomp before 2.4.0 did not correctly generate     64-bit syscall argument comparisons using the     arithmetic operators (LT, GT, LE, GE), which might able     to lead to bypassing seccomp filters and potential     privilege escalations.(CVE-2019-9893)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3583 advisory.

  - libsolv: illegal address access in pool_whatprovides in src/pool.h (CVE-2018-20534)

  - libcomps: use after free when merging two objmrtrees (CVE-2019-3817)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libcomps fixes the following issue: &#9; Security issue fixed :

  - CVE-2019-3817: Fixed a use-after-free vulnerability in     comps_objmradix.c:comps_objmrtree_unite() function where     could allow to application crash or code execution     (bsc#1122841).

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3898 advisory.

  - libcomps: use after free when merging two objmrtrees (CVE-2019-3817)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2019:3583 advisory.

  - ** DISPUTED ** There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2     that will cause a denial of service. NOTE: third parties dispute this issue stating that the issue affects     the test suite and not the underlying library. It cannot be exploited in any real-world application.
    (CVE-2018-20534)

  - A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are     merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to     crash the application or execute malicious code. (CVE-2019-3817)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
130555	RHEL 8 : yum (RHSA-2019:3583)	Nessus	Red Hat Local Security Checks	11/6/2019	4/28/2024	high
180746	Oracle Linux 8 : yum (ELSA-2019-3583)	Nessus	Oracle Linux Local Security Checks	9/7/2023	9/7/2023	high
134785	EulerOS 2.0 SP8 : libcomps (EulerOS-SA-2020-1293)	Nessus	Huawei Local Security Checks	3/23/2020	3/21/2024	critical
145590	CentOS 8 : yum (CESA-2019:3583)	Nessus	CentOS Local Security Checks	1/29/2021	1/25/2024	high
122772	openSUSE Security Update : libcomps (openSUSE-2019-323)	Nessus	SuSE Local Security Checks	3/12/2019	1/19/2021	high
131152	RHEL 7 : libcomps (RHSA-2019:3898)	Nessus	Red Hat Local Security Checks	11/20/2019	4/28/2024	high
157691	AlmaLinux 8 : yum (ALSA-2019:3583)	Nessus	Alma Linux Local Security Checks	2/9/2022	11/10/2023	high

Detections

Analytics

Plugins Search

high

high

critical

high

high

high

high