The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code     execution (CVE-2019-6446)

  - __init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink     attack on a temporary file. (CVE-2014-1858)

  - (1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4)     lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink     attack on a temporary file. (CVE-2014-1859)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code     execution (CVE-2019-6446)

  - __init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink     attack on a temporary file. (CVE-2014-1858)

  - (1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4)     lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink     attack on a temporary file. (CVE-2014-1859)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3954-1 advisory.

  - The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or     ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.
    (CVE-2017-12852)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the python package has been released.

ID	Name	Product	Family	Severity
199799	RHEL 6 : numpy (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199759	RHEL 7 : numpy (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196498	RHEL 6 : numpy (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196472	RHEL 7 : numpy (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
167350	SUSE SLES12 Security Update : python-numpy (SUSE-SU-2022:3954-1)	Nessus	SuSE Local Security Checks	high
152052	Photon OS 1.0: Python PHSA-2021-1.0-0416	Nessus	PhotonOS Local Security Checks	high
152050	Photon OS 2.0: Python PHSA-2021-2.0-0371	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2017-12852

high

Tenable Plugins

critical

critical

critical

critical

high

high

high