A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - gsl: Stack buffer overflow in gsl_stats_quantile_from_sorted_data (CVE-2020-35357)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - gsl: Stack buffer overflow in gsl_stats_quantile_from_sorted_data (CVE-2020-35357)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 ESM / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6472-1 advisory.

  - A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU     Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for     gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or     arbitrary code execution. (CVE-2020-35357)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4051-1 advisory.

  - A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU     Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for     gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or     arbitrary code execution. (CVE-2020-35357)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of gsl installed on the remote host is prior to 1.13-4.4. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1851 advisory.

  - A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU     Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for     gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or     arbitrary code execution. (CVE-2020-35357)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3858-1 advisory.

  - A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU     Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for     gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or     arbitrary code execution. (CVE-2020-35357)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3576 advisory.

  - A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU     Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for     gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or     arbitrary code execution. (CVE-2020-35357)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-353 advisory.

  - A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU     Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for     gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or     arbitrary code execution. (CVE-2020-35357)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of gsl installed on the remote host is prior to 1.15-13. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2255 advisory.

  - A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU     Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for     gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or     arbitrary code execution. (CVE-2020-35357)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3527-1 advisory.

  - A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU     Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for     gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or     arbitrary code execution. (CVE-2020-35357)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199700	RHEL 8 : gsl (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
199686	RHEL 9 : gsl (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
185162	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 ESM / 23.04 : GNU Scientific Library vulnerability (USN-6472-1)	Nessus	Ubuntu Local Security Checks	medium
183004	SUSE SLED12 / SLES12 Security Update : gsl (SUSE-SU-2023:4051-1)	Nessus	SuSE Local Security Checks	medium
182714	Amazon Linux AMI : gsl (ALAS-2023-1851)	Nessus	Amazon Linux Local Security Checks	medium
182184	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : gsl (SUSE-SU-2023:3858-1)	Nessus	SuSE Local Security Checks	medium
181775	Debian DLA-3576-1 : gsl - LTS security update	Nessus	Debian Local Security Checks	medium
181723	Amazon Linux 2023 : gsl, gsl-devel (ALAS2023-2023-353)	Nessus	Amazon Linux Local Security Checks	medium
181710	Amazon Linux 2 : gsl (ALAS-2023-2255)	Nessus	Amazon Linux Local Security Checks	medium
180538	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : gsl (SUSE-SU-2023:3527-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2020-35357

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium