An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary     libraries (CVE-2017-16997)

  - glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-     read (CVE-2019-9169)

  - The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in     accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-     free vulnerabilities. (CVE-2014-4043)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary     libraries (CVE-2017-16997)

  - glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-     read (CVE-2019-9169)

  - In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses     alternatives, which allows attackers to cause a denial of service (assertion failure and application exit)     or trigger an incorrect result by attempting a regular-expression match. (CVE-2009-5155)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary     libraries (CVE-2017-16997)

  - glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-     read (CVE-2019-9169)

  - In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses     alternatives, which allows attackers to cause a denial of service (assertion failure and application exit)     or trigger an incorrect result by attempting a regular-expression match. (CVE-2009-5155)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3092 advisory.

  - elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH     containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain     privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and     decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the     ./ directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very     uncommon; most likely, no such program is shipped with any common Linux distribution. (CVE-2017-16997)

  - An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library     (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that     is too small, potentially leading to heap corruption. (CVE-2018-6485)

  - stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very     long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit     architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.
    (CVE-2018-11236)

  - An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27     and earlier may write data beyond the target buffer, leading to a buffer overflow in
    __mempcpy_avx512_no_vzeroupper. (CVE-2018-11237)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Florian Weimer discovered that the GNU C Library incorrectly handled certain memory operations. A remote attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-12133) It was discovered that the GNU C Library incorrectly handled certain SSE2-optimized memmove operations. A remote attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-18269) It was discovered that the GNU C Library incorrectly handled certain pathname operations. A remote attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-11236) It was discovered that the GNU C Library incorrectly handled certain AVX-512-optimized mempcpy operations. A remote attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-11237) It was discovered that the GNU C Library incorrectly handled certain hostname loookups. A remote attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS.
(CVE-2018-19591) Jakub Wilk discovered that the GNU C Library incorrectly handled certain memalign functions. A remote attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-6485) It was discovered that the GNU C Library incorrectly ignored the LD_PREFER_MAP_32BIT_EXEC environment variable after security transitions. A local attacker could use this issue to bypass ASLR restrictions. (CVE-2019-19126) It was discovered that the GNU C Library incorrectly handled certain regular expressions. A remote attacker could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of service.
This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
(CVE-2019-9169) It was discovered that the GNU C Library incorrectly handled certain bit patterns. A remote attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-10029) It was discovered that the GNU C Library incorrectly handled certain signal trampolines on PowerPC. A remote attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2020-1751) It was discovered that the GNU C Library incorrectly handled tilde expansion. A remote attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2020-1752).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has glibc packages installed that are affected by multiple vulnerabilities:

  - An integer overflow in the implementation of the     posix_memalign in memalign functions in the GNU C     Library (aka glibc or libc6) 2.26 and earlier could     cause these functions to return a pointer to a heap area     that is too small, potentially leading to heap     corruption. (CVE-2018-6485)

  - elf/dl-load.c in the GNU C Library (aka glibc or libc6)     2.19 through 2.26 mishandles RPATH and RUNPATH     containing $ORIGIN for a privileged (setuid or     AT_SECURE) program, which allows local users to gain     privileges via a Trojan horse library in the current     working directory, related to the fillin_rpath and     decompose_rpath functions. This is associated with     misinterpretion of an empty RPATH/RUNPATH token as the     ./ directory. NOTE: this configuration of     RPATH/RUNPATH for a privileged program is apparently     very uncommon; most likely, no such program is shipped     with any common Linux distribution. (CVE-2017-16997)

  - A buffer overflow has been discovered in the GNU C     Library (aka glibc or libc6) in the
    __mempcpy_avx512_no_vzeroupper function when particular     conditions are met. An attacker could use this     vulnerability to cause a denial of service or     potentially execute code. (CVE-2018-11237)

  - stdlib/canonicalize.c in the GNU C Library (aka glibc or     libc6) 2.27 and earlier, when processing very long     pathname arguments to the realpath function, could     encounter an integer overflow on 32-bit architectures,     leading to a stack-based buffer overflow and,     potentially, arbitrary code execution. (CVE-2018-11236)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - stdlib/canonicalize.c in the GNU C Library (aka glibc     or libc6) 2.27 and earlier, when processing very long     pathname arguments to the realpath function, could     encounter an integer overflow on 32-bit architectures,     leading to a stack-based buffer overflow and,     potentially, arbitrary code execution.(CVE-2018-11236)

  - An integer overflow vulnerability was found in     hcreate() and hcreate_r() functions which could result     in an out-of-bounds memory access. This could lead to     application crash or, potentially, arbitrary code     execution.(CVE-2015-8778)

  - A stack-based buffer overflow was found in the way the     libresolv library performed dual A/AAAA DNS queries. A     remote attacker could create a specially crafted DNS     response which could cause libresolv to crash or,     potentially, execute code with the permissions of the     user running the library. Note: this issue is only     exposed when libresolv is called from the nss_dns NSS     service module.(CVE-2015-7547)

  - A flaw was found in the regular expression matching     routines that process multibyte character input. If an     application utilized the glibc regular expression     matching mechanism, an attacker could provide     specially-crafted input that, when processed, would     cause the application to crash.(CVE-2013-0242)

  - A flaw was found in the way memory was being allocated     on the stack for user space binaries. If heap (or     different memory region) and stack memory regions were     adjacent to each other, an attacker could use this flaw     to jump over the stack guard gap, cause controlled     memory corruption on process stack or the adjacent     memory region, and thus increase their privileges on     the system. This is glibc-side mitigation which blocks     processing of LD_LIBRARY_PATH for programs running in     secure-execution mode and reduces the number of     allocations performed by the processing of LD_AUDIT,     LD_PRELOAD, and LD_HWCAP_MASK, making successful     exploitation of this issue more     difficult.(CVE-2017-1000366)

  - The DNS stub resolver in the GNU C Library (aka glibc     or libc6) before version 2.26, when EDNS support is     enabled, will solicit large UDP responses from name     servers, potentially simplifying off-path DNS spoofing     attacks due to IP fragmentation.(CVE-2017-12132)

  - It was found that the files back end of Name Service     Switch (NSS) did not isolate iteration over an entire     database from key-based look-up API calls. An     application performing look-ups on a database while     iterating over it could enter an infinite loop, leading     to a denial of service.(CVE-2014-8121)

  - Stack-based buffer overflow in the getaddrinfo function     in sysdeps/posix/getaddrinfo.c in the GNU C Library     (aka glibc or libc6) allows remote attackers to cause a     denial of service (crash) via vectors involving hostent     conversion. NOTE: this vulnerability exists because of     an incomplete fix for CVE-2013-4458.(CVE-2016-3706)

  - In glibc 2.26 and earlier there is confusion in the     usage of getcwd() by realpath() which can be used to     write before the destination buffer leading to a buffer     underflow and potential code     execution.(CVE-2018-1000001)

  - Stack-based buffer overflow in string/strcoll_l.c in     the GNU C Library (aka glibc or libc6) 2.17 and earlier     allows context-dependent attackers to cause a denial of     service (crash) or possibly execute arbitrary code via     a long string that triggers a malloc failure and use of     the alloca function.(CVE-2012-4424)

  - It was found that the dynamic loader did not sanitize     the LD_POINTER_GUARD environment variable. An attacker     could use this flaw to bypass the pointer guarding     protection on set-user-ID or set-group-ID programs to     execute arbitrary code with the permissions of the user     running the application.(CVE-2015-8777)

  - The glob function in glob.c in the GNU C Library (aka     glibc or libc6) before 2.27 contains a buffer overflow     during unescaping of user names with the ~     operator.(CVE-2017-15804)

  - res_query in libresolv in glibc before 2.25 allows     remote attackers to cause a denial of service (NULL     pointer dereference and process crash).(CVE-2015-5180)

  - pt_chown in GNU C Library (aka glibc or libc6) before     2.18 does not properly check permissions for tty files,     which allows local users to change the permission on     the files and obtain access to arbitrary     pseudo-terminals by leveraging a FUSE file     system.(CVE-2013-2207)

  - A stack overflow flaw was found in glibc's swscanf()     function. An attacker able to make an application call     the swscanf() function could use this flaw to crash     that application or, potentially, execute arbitrary     code with the permissions of the user running the     application.(CVE-2015-1473)

  - It was found that getaddrinfo() did not limit the     amount of stack memory used during name resolution. An     attacker able to make an application resolve an     attacker-controlled hostname or IP address could     possibly cause the application to exhaust all stack     memory and crash.(CVE-2013-4458)

  - A heap-based buffer overflow was found in glibc's
    __nss_hostname_digits_dots() function, which is used by     the gethostbyname() and gethostbyname2() glibc function     calls. A remote attacker able to make an application     call either of these functions could use this flaw to     execute arbitrary code with the permissions of the user     running the application.(CVE-2015-0235)

  - Multiple integer overflow flaws, leading to heap-based     buffer overflows, were found in glibc's memory     allocator functions (pvalloc, valloc, and memalign). If     an application used such a function, it could cause the     application to crash or, potentially, execute arbitrary     code with the privileges of the user running the     application.(CVE-2013-4332)

  - An integer overflow in the implementation of the     posix_memalign in memalign functions in the GNU C     Library (aka glibc or libc6) 2.26 and earlier could     cause these functions to return a pointer to a heap     area that is too small, potentially leading to heap     corruption.(CVE-2018-6485)

  - A stack based buffer overflow vulnerability was found     in the catopen() function. An excessively long string     passed to the function could cause it to crash or,     potentially, execute arbitrary code.(CVE-2015-8779)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - An integer overflow in the implementation of the     posix_memalign in memalign functions in the GNU C     Library (aka glibc or libc6) 2.26 and earlier could     cause these functions to return a pointer to a heap     area that is too small, potentially leading to heap     corruption.i1/4^CVE-2018-6485i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An integer overflow in the implementation of the     posix_memalign in memalign functions in the GNU C     Library (aka glibc or libc6) 2.26 and earlier could     cause these functions to return a pointer to a heap     area that is too small, potentially leading to heap     corruption.(CVE-2018-6485)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - stdlib/canonicalize.c in the GNU C Library (aka glibc     or libc6) 2.27 and earlier, when processing very long     pathname arguments to the realpath function, could     encounter an integer overflow on 32-bit architectures,     leading to a stack-based buffer overflow and,     potentially, arbitrary code execution.(CVE-2018-11236)

  - An integer overflow in the implementation of the     posix_memalign in memalign functions in the GNU C     Library (aka glibc or libc6) 2.26 and earlier could     cause these functions to return a pointer to a heap     area that is too small, potentially leading to heap     corruption.(CVE-2018-6485)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the glibc package has been released.

A buffer overflow has been discovered in the GNU C Library (aka glibc or libc6) in the __mempcpy_avx512_no_vzeroupper function when particular conditions are met. An attacker could use this vulnerability to cause a denial of service or potentially execute code.(CVE-2018-11237)

elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions.
This is associated with misinterpretion of an empty RPATH/RUNPATH token as the './' directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.(CVE-2017-16997)

stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.(CVE-2018-11236)

An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption.(CVE-2018-6485)

Security Fix(es) :

  - glibc: Incorrect handling of RPATH in elf/dl-load.c can     be used to execute code loaded from arbitrary libraries     (CVE-2017-16997)

  - glibc: Integer overflow in posix_memalign in memalign     functions (CVE-2018-6485)

  - glibc: Integer overflow in stdlib/canonicalize.c on     32-bit architectures leading to stack-based buffer     overflow (CVE-2018-11236)

  - glibc: Buffer overflow in __mempcpy_avx512_no_vzeroupper     (CVE-2018-11237)

An update for glibc is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es) :

* glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary libraries (CVE-2017-16997)

* glibc: Integer overflow in posix_memalign in memalign functions (CVE-2018-6485)

* glibc: Integer overflow in stdlib/canonicalize.c on 32-bit architectures leading to stack-based buffer overflow (CVE-2018-11236)

* glibc: Buffer overflow in __mempcpy_avx512_no_vzeroupper (CVE-2018-11237)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3092 advisory.

  - glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary     libraries (CVE-2017-16997)

  - glibc: Integer overflow in posix_memalign in memalign functions (CVE-2018-6485)

  - glibc: Integer overflow in stdlib/canonicalize.c on 32-bit architectures leading to stack-based buffer     overflow (CVE-2018-11236)

  - glibc: Buffer overflow in __mempcpy_avx512_no_vzeroupper (CVE-2018-11237)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Integer overflow in malloc functions :

The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption. (CVE-2018-6551)

Integer overflow in posix_memalign in memalign functions :

An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption.
(CVE-2018-6485)

The remote host is affected by the vulnerability described in GLSA-201804-02 (glibc: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in glibc. Please review       the CVE identifiers referenced below for details.
  Impact :

    An attacker could possibly execute arbitrary code, escalate privileges,       cause a Denial of Service condition, or have other unspecified impacts.
  Workaround :

    There is no known workaround at this time.

This update fixes two minor security vulnerabilities in `malloc` (CVE-2018-6485, CVE-2018-6551, RHBZ#1542102, RHBZ#1542119), and provides a C++ version of `iseqsig`.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for glibc fixes the following issues: Security issues :

  - CVE-2017-8804: Fix memory leak after deserialization     failure in xdr_bytes, xdr_string (bsc#1037930)

  - CVE-2017-12132: Reduce EDNS payload size to 1200 bytes     (bsc#1051791)

  - CVE-2018-6485,CVE-2018-6551: Fix integer overflows in     internal memalign and malloc functions (bsc#1079036)

  - CVE-2018-1000001: Avoid underflow of malloced area in     realpath (bsc#1074293) Also a non security issue was     fixed :

  - Do not fail if one of the two responses to AF_UNSPEC     fails (bsc#978209)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for glibc fixes the following issues :

Security issues fixed :

  - CVE-2017-8804: Fix memory leak after deserialization     failure in xdr_bytes, xdr_string (bsc#1037930)

  - CVE-2017-12132: Reduce EDNS payload size to 1200 bytes     (bsc#1051791)

  - CVE-2018-6485,CVE-2018-6551: Fix integer overflows in     internal memalign and malloc functions (bsc#1079036)

  - CVE-2018-1000001: Avoid underflow of malloced area     (bsc#1074293)

Non security bugs fixed :

  - Release read lock after resetting timeout (bsc#1073990)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for glibc fixes the following issues: Security issues fixed :

  - CVE-2017-8804: Fix memory leak after deserialization     failure in xdr_bytes, xdr_string (bsc#1037930)

  - CVE-2017-12132: Reduce EDNS payload size to 1200 bytes     (bsc#1051791)

  - CVE-2018-6485,CVE-2018-6551: Fix integer overflows in     internal memalign and malloc functions (bsc#1079036)

  - CVE-2018-1000001: Avoid underflow of malloced area     (bsc#1074293) Non security bugs fixed :

  - Release read lock after resetting timeout (bsc#1073990)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199112	RHEL 7 : glibc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199103	RHEL 6 : glibc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199014	RHEL 5 : glibc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
180807	Oracle Linux 7 : glibc (ELSA-2018-3092)	Nessus	Oracle Linux Local Security Checks	critical
138166	Ubuntu 16.04 LTS / 18.04 LTS : GNU C Library vulnerabilities (USN-4416-1)	Nessus	Ubuntu Local Security Checks	critical
127214	NewStart CGSL CORE 5.04 / MAIN 5.04 : glibc Multiple Vulnerabilities (NS-SA-2019-0040)	Nessus	NewStart CGSL Local Security Checks	critical
125004	EulerOS Virtualization 3.0.1.0 : glibc (EulerOS-SA-2019-1551)	Nessus	Huawei Local Security Checks	critical
123911	EulerOS Virtualization 2.5.4 : glibc (EulerOS-SA-2019-1225)	Nessus	Huawei Local Security Checks	critical
123768	EulerOS Virtualization 2.5.3 : glibc (EulerOS-SA-2019-1228)	Nessus	Huawei Local Security Checks	critical
122377	EulerOS 2.0 SP2 : glibc (EulerOS-SA-2019-1050)	Nessus	Huawei Local Security Checks	critical
122172	EulerOS 2.0 SP5 : glibc (EulerOS-SA-2019-1025)	Nessus	Huawei Local Security Checks	critical
122171	EulerOS 2.0 SP3 : glibc (EulerOS-SA-2019-1024)	Nessus	Huawei Local Security Checks	critical
121924	Photon OS 2.0: Glibc PHSA-2018-2.0-0020	Nessus	PhotonOS Local Security Checks	critical
121812	Photon OS 1.0: Glibc PHSA-2018-1.0-0111	Nessus	PhotonOS Local Security Checks	critical
119468	Amazon Linux AMI : glibc (ALAS-2018-1109)	Nessus	Amazon Linux Local Security Checks	critical
119182	Scientific Linux Security Update : glibc on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	critical
118992	CentOS 7 : glibc (CESA-2018:3092)	Nessus	CentOS Local Security Checks	critical
118527	RHEL 7 : glibc (RHSA-2018:3092)	Nessus	Red Hat Local Security Checks	critical
109141	Amazon Linux 2 : glibc (ALAS-2018-992)	Nessus	Amazon Linux Local Security Checks	critical
108822	GLSA-201804-02 : glibc: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
107158	Fedora 27 : glibc (2018-1cbdc8cbb8)	Nessus	Fedora Local Security Checks	critical
107086	SUSE SLES11 Security Update : glibc (SUSE-SU-2018:0565-1)	Nessus	SuSE Local Security Checks	critical
106916	openSUSE Security Update : glibc (openSUSE-2018-184)	Nessus	SuSE Local Security Checks	critical
106865	SUSE SLED12 / SLES12 Security Update : glibc (SUSE-SU-2018:0451-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2018-6485

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical