Detections
Analytics
GLSA-202312-09 : NASM: Multiple Vulnerabilities
high Nessus Plugin ID 187216
Language:
Description
The remote host is affected by the vulnerability described in GLSA-202312-09 (NASM: Multiple Vulnerabilities)- In Netwide Assembler (NASM) 2.14.02, there is a use-after-free in paste_tokens in asm/preproc.c.
(CVE-2019-8343)
- A Segmentation Fault issue discovered in in ieee_segment function in outieee.c in nasm 2.14.03 and 2.15 allows remote attackers to cause a denial of service via crafted assembly file. (CVE-2020-21528)
- NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856 (CVE-2022-44370)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
All NASM users should upgrade to the latest version:# emerge --sync # emerge --ask --oneshot --verbose >=dev-lang/nasm-2.16.01
See Also
https://security.gentoo.org/glsa/202312-09
Plugin Details
Severity: High
ID: 187216
File Name: gentoo_GLSA-202312-09.nasl
Version: 1.0
Type: local
Family: Gentoo Local Security Checks
Published: 12/22/2023
Updated: 12/22/2023
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2019-8343
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 7
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS Score Source: CVE-2022-44370
Vulnerability Information
CPE: p-cpe:/a:gentoo:linux:nasm, cpe:/o:gentoo:linux
Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 12/22/2023
Vulnerability Publication Date: 2/15/2019