Updated mpfr packages fix security vulnerability :

A buffer overflow was reported in mpfr. This is due to incorrect GMP documentation for mpn_set_str about the size of a buffer (CVE-2014-9474).

The remote host is affected by the vulnerability described in GLSA-201512-06 (MPFR: User-assisted execution of arbitrary code)

    MPFR fails to adequately check user-supplied input, which could lead to       a buffer overflow.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

According to the version of the mpfr packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Buffer overflow in the mpfr_strtofr function in GNU     MPFR before 3.1.2-p11 allows context-dependent     attackers to have unspecified impact via vectors     related to incorrect documentation for     mpn_set_str.(CVE-2014-9474)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libmpfr fixes a buffer overflow in mpfr_strtofr.
(CVE-2014-9474)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - mpfr: buffer overflow in mpfr_strtofr (CVE-2014-9474)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - mpfr: buffer overflow in mpfr_strtofr (CVE-2014-9474)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
82396	Mandriva Linux Security Advisory : mpfr (MDVSA-2015:143)	Nessus	Mandriva Local Security Checks	3/30/2015	1/14/2021	high
87706	GLSA-201512-06 : MPFR: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	1/4/2016	1/11/2021	critical
104912	EulerOS 2.0 SP2 : mpfr (EulerOS-SA-2017-1294)	Nessus	Huawei Local Security Checks	12/1/2017	1/6/2021	critical
105164	EulerOS 2.0 SP1 : mpfr (EulerOS-SA-2017-1293)	Nessus	Huawei Local Security Checks	12/12/2017	1/6/2021	critical
80404	Fedora 20 : mpfr-3.1.2-5.fc20 (2014-16964)	Nessus	Fedora Local Security Checks	1/8/2015	1/11/2021	critical
80405	Fedora 21 : mpfr-3.1.2-8.fc21 (2014-16967)	Nessus	Fedora Local Security Checks	1/8/2015	1/11/2021	critical
80562	Mandriva Linux Security Advisory : mpfr (MDVSA-2015:025)	Nessus	Mandriva Local Security Checks	1/16/2015	1/6/2021	high
81176	SuSE 11.3 Security Update : libmpfr (SAT Patch Number 10212)	Nessus	SuSE Local Security Checks	2/5/2015	1/6/2021	high
198854	RHEL 7 : mpfr (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	critical
198867	RHEL 6 : mpfr (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	critical

Detections

Analytics

Plugins Search

high

critical

critical

critical

critical

critical

high

high

critical

critical