When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough     space for the assertion failure message string and size information, which may lead to a buffer overflow     if the message string size aligns to page size. (CVE-2025-0395)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:0510-1 advisory.

    This update for glibc fixes the following issue:

    - CVE-2025-0395: Fix underallocation of abort_msg_s struct (bsc#1236282, BZ #32582))

    - s390x-wcsncmp patch: s390x: Fix segfault in wcsncmp (bsc#1228044).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0582-1 advisory.

    - CVE-2025-0395: Fix underallocation of abort_msg_s struct (bsc#1236282)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0562-1 advisory.

    - CVE-2025-0395: Fix underallocation of abort_msg_s struct (bsc#1236282)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7259-2 advisory.

    USN-7259-1 fixed a vulnerability in GNU C Library. This update provides the corresponding update for     Ubuntu 16.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7259-3 advisory.

    USN-7259-1 fixed a vulnerability in GNU C Library. This update provides the corresponding update for     Ubuntu 14.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7259-1 advisory.

    It was discovered that GNU C Library incorrectly handled memory when using the assert function. An     attacker could possibly use this issue to cause a denial of service or execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-497995b101 advisory.

    This update addresses two security vulnerabilities:
    * CVE-2025-0395: A buffer overflow may occur in the `assert` function with certain large program names and     `assert` expressions.
    * CVE-2025-0577: getrandom, arc4random can produce predictable randomness if a multi-threaded program     creates additional threads after fork.
    The following non-security bugs are fixed:
    * Compatibility with certain programs that call `free(environ)` is improved (however, deallocating     `environ` remains undefined in general).
    * On certain non-Fedora kernels, `mkstemp` and other functions may not attempt to create multiple     different file names and fail with `EEXISTS`.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-69207650a4 advisory.

    This update addresses two security vulnerabilities:
    * CVE-2025-0395: A buffer overflow may occur in the `assert` function with certain large program names and     `assert` expressions.
    * CVE-2025-0577: getrandom, arc4random can produce predictable randomness if a multi-threaded program     creates additional threads after fork.
    The following non-security bugs are fixed:
    * Compatibility with certain programs that call `free(environ)` is improved (however, deallocating     `environ` remains undefined in general).
    * Crashes in string functions on certain hypervisors that report L3 cache sizes above 4 GiB are avoided.
    * Poor performance of x86-64 string functions in certain cases.
    * Initialization of the restartable sequence area now follows recommended practices.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
231800	Linux Distros Unpatched Vulnerability : CVE-2025-0395	Nessus	Misc.	high
216461	SUSE SLES12 Security Update : glibc (SUSE-SU-2025:0510-1)	Nessus	SuSE Local Security Checks	high
216455	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : glibc (SUSE-SU-2025:0582-1)	Nessus	SuSE Local Security Checks	high
216449	SUSE SLES15 Security Update : glibc (SUSE-SU-2025:0562-1)	Nessus	SuSE Local Security Checks	high
215239	Ubuntu 16.04 LTS : GNU C Library vulnerability (USN-7259-2)	Nessus	Ubuntu Local Security Checks	high
215237	Ubuntu 14.04 LTS : GNU C Library vulnerability (USN-7259-3)	Nessus	Ubuntu Local Security Checks	high
215062	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : GNU C Library vulnerability (USN-7259-1)	Nessus	Ubuntu Local Security Checks	high
214654	Fedora 41 : glibc (2025-497995b101)	Nessus	Fedora Local Security Checks	high
214653	Fedora 40 : glibc (2025-69207650a4)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2025-0395

high

Tenable Plugins

high

high

high

high

high

high

high

high

high