The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3352 advisory.

  - libiberty: Memory leak in demangle_template function resulting in a denial of service (CVE-2018-20657)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the crash package has been released.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3352 advisory.

    [8.2-6.el8]
    - Fix yum vs dnf messaging for RHEL8 (RH BZ 1666249):
      Add gdb-rhbz1666249-suggest-yum-instead-of-dnf.pattch       Do not define DNF_DEBUGINFO_INSTALL for RHEL.
    - Backport 'Remove support for old mangling schemes'       (Simon Marchi, RH BZ 1668635)
    - Backport 'Add checks for the NT_ARM_SVE section in a core file.'       (Alan Hayward, RH BZ 1669953)
    - Backport more Power8 support (IBM, RH BZ 1187581)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the gcc packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The gcc package contains the GNU Compiler Collection     version 4.8.You'll need this package in order to     compile C code.Security Fix(es):The demangle_template     function in cplus-dem.c in GNU libiberty, as     distributed in GNU Binutils 2.31.1, has a memory leak     via a crafted string, leading to a denial of service     (memory consumption), as demonstrated by cxxfilt, a     related issue to CVE-2018-12698.(CVE-2018-20657)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The demangle_template function in cplus-dem.c in GNU     libiberty, as distributed in GNU Binutils 2.31.1,     contains an integer overflow vulnerability (for 'Create     an array for saving the template argument values') that     can trigger a heap-based buffer overflow, as     demonstrated by nm.(CVE-2018-20673)

  - The demangle_template function in cplus-dem.c in GNU     libiberty, as distributed in GNU Binutils 2.31.1, has a     memory leak via a crafted string, leading to a denial     of service (memory consumption), as demonstrated by     cxxfilt, a related issue to     CVE-2018-12698.(CVE-2018-20657)

  - The get_count function in cplus-dem.c in GNU libiberty,     as distributed in GNU Binutils 2.31, allows remote     attackers to cause a denial of service (malloc called     with the result of an integer-overflowing calculation)     or possibly have unspecified other impact via a crafted     string, as demonstrated by c++filt.(CVE-2018-18483)

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32.
    simple_object_elf_match in simple-object-elf.c does not     check for a zero shstrndx value, leading to an integer     overflow and resultant heap-based buffer     overflow.(CVE-2019-14250)

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32. It is a heap-based     buffer over-read in d_expression_1 in cp-demangle.c     after many recursive calls.(CVE-2019-9070)

  - An issue was discovered in the Binary File Descriptor     (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an attempted excessive memory     allocation in elf_read_notes in elf.c.(CVE-2019-9076)

  - An issue was discovered in the Binary File Descriptor     (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an out-of-bounds read leading to a     SEGV in bfd_getl32 in libbfd.c, when called from     pex64_get_runtime_function in     pei-x86_64.c.(CVE-2019-9074)

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32. It is a stack     consumption issue in d_count_templates_scopes in     cp-demangle.c after many recursive     calls.(CVE-2019-9071)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x     through 2.6.4 allows HTTP Response Splitting. If a     program using WEBrick inserts untrusted input into the     response header, an attacker can exploit it to insert a     newline character to split a header, and inject     malicious content to deceive clients. NOTE: this issue     exists because of an incomplete fix for CVE-2017-17742,     which addressed the CRLF vector, but did not address an     isolated CR or an isolated LF.(CVE-2019-9076)

  - An issue was discovered in the Binary File Descriptor     (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an attempted excessive memory     allocation in elf_read_notes in elf.c.(CVE-2019-9074)

  - An issue was discovered in the Binary File Descriptor     (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an out-of-bounds read leading to a     SEGV in bfd_getl32 in libbfd.c, when called from     pex64_get_runtime_function in     pei-x86_64.c.(CVE-2019-14250)

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32. It is a stack     consumption issue in d_count_templates_scopes in     cp-demangle.c after many recursive     calls.(CVE-2019-9071)

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32. It is a heap-based     buffer over-read in d_expression_1 in cp-demangle.c     after many recursive calls.(CVE-2019-9070)

  - The demangle_template function in cplus-dem.c in GNU     libiberty, as distributed in GNU Binutils 2.31.1, has a     memory leak via a crafted string, leading to a denial     of service (memory consumption), as demonstrated by     cxxfilt, a related issue to     CVE-2018-12698.(CVE-2018-20657)

  - The get_count function in cplus-dem.c in GNU libiberty,     as distributed in GNU Binutils 2.31, allows remote     attackers to cause a denial of service (malloc called     with the result of an integer-overflowing calculation)     or possibly have unspecified other impact via a crafted     string, as demonstrated by c++filt.(CVE-2018-18483)

  - The _bfd_generic_read_minisymbols function in syms.c in     the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.31, has a memory leak     via a crafted ELF file, leading to a denial of service     (memory consumption), as demonstrated by     nm.(CVE-2018-20002)

  - apply_relocations in readelf.c in GNU Binutils 2.32     contains an integer overflow that allows attackers to     trigger a write access violation (in     byte_put_little_endian function in elfcomm.c) via an     ELF file, as demonstrated by readelf.(CVE-2019-14444)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32.
    simple_object_elf_match in simple-object-elf.c does not     check for a zero shstrndx value, leading to an integer     overflow and resultant heap-based buffer     overflow.(CVE-2019-14250)

  - An issue was discovered in the Binary File Descriptor     (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an attempted excessive memory     allocation in elf_read_notes in elf.c.(CVE-2019-9076)

  - An issue was discovered in the Binary File Descriptor     (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an out-of-bounds read leading to a     SEGV in bfd_getl32 in libbfd.c, when called from     pex64_get_runtime_function in     pei-x86_64.c.(CVE-2019-9074)

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32. It is a stack     consumption issue in d_count_templates_scopes in     cp-demangle.c after many recursive     calls.(CVE-2019-9071)

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32. It is a heap-based     buffer over-read in d_expression_1 in cp-demangle.c     after many recursive calls.(CVE-2019-9070)

  - The demangle_template function in cplus-dem.c in GNU     libiberty, as distributed in GNU Binutils 2.31.1, has a     memory leak via a crafted string, leading to a denial     of service (memory consumption), as demonstrated by     cxxfilt, a related issue to     CVE-2018-12698.(CVE-2018-20657)

  - The get_count function in cplus-dem.c in GNU libiberty,     as distributed in GNU Binutils 2.31, allows remote     attackers to cause a denial of service (malloc called     with the result of an integer-overflowing calculation)     or possibly have unspecified other impact via a crafted     string, as demonstrated by c++filt.(CVE-2018-18483)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the gcc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - The demangle_template function in cplus-dem.c in GNU     libiberty, as distributed in GNU Binutils 2.31.1, has a     memory leak via a crafted string, leading to a denial     of service (memory consumption), as demonstrated by     cxxfilt, a related issue to     CVE-2018-12698.(CVE-2018-20657)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the gdb packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The demangle_template function in cplus-dem.c in GNU     libiberty, as distributed in GNU Binutils 2.31.1, has a     memory leak via a crafted string, leading to a denial     of service (memory consumption), as demonstrated by     cxxfilt, a related issue to     CVE-2018-12698.(CVE-2018-20657)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has     a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated     by cxxfilt, a related issue to CVE-2018-12698. (CVE-2018-20657)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3352 advisory.

    The GNU Debugger (GDB) allows users to debug programs written in various programming languages including     C, C++, and Fortran.

    Security Fix(es):

    * libiberty: Memory leak in demangle_template function resulting in a denial of service (CVE-2018-20657)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32. It is a heap-based     buffer over-read in d_expression_1 in cp-demangle.c     after many recursive calls.(CVE-2019-9070)

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32. It is a stack     consumption issue in d_count_templates_scopes in     cp-demangle.c after many recursive     calls.(CVE-2019-9071)

  - An issue was discovered in GNU libiberty, as     distributed in GNU Binutils 2.32.
    simple_object_elf_match in simple-object-elf.c does not     check for a zero shstrndx value, leading to an integer     overflow and resultant heap-based buffer     overflow.(CVE-2019-14250)

  - An issue was discovered in the Binary File Descriptor     (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an attempted excessive memory     allocation in elf_read_notes in elf.c.(CVE-2019-9076)

  - An issue was discovered in the Binary File Descriptor     (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an out-of-bounds read leading to a     SEGV in bfd_getl32 in libbfd.c, when called from     pex64_get_runtime_function in     pei-x86_64.c.(CVE-2019-9074)

  - GNU gdb All versions is affected by: Buffer Overflow -     Out of bound memory access. The impact is: Deny of     Service, Memory Disclosure, and Possible Code     Execution. The component is: The main gdb module. The     attack vector is: Open an ELF for debugging. The fixed     version is: Not fixed yet.(CVE-2019-1010180)

  - The demangle_template function in cplus-dem.c in GNU     libiberty, as distributed in GNU Binutils 2.31.1, has a     memory leak via a crafted string, leading to a denial     of service (memory consumption), as demonstrated by     cxxfilt, a related issue to     CVE-2018-12698.(CVE-2018-20657)

  - The get_count function in cplus-dem.c in GNU libiberty,     as distributed in GNU Binutils 2.31, allows remote     attackers to cause a denial of service (malloc called     with the result of an integer-overflowing calculation)     or possibly have unspecified other impact via a crafted     string, as demonstrated by c++filt.(CVE-2018-18483)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
145633	CentOS 8 : gdb (CESA-2019:3352)	Nessus	CentOS Local Security Checks	1/29/2021	1/25/2024	high
203822	Photon OS 3.0: Crash PHSA-2023-3.0-0601	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	critical
180781	Oracle Linux 8 : gdb (ELSA-2019-3352)	Nessus	Oracle Linux Local Security Checks	9/7/2023	11/1/2024	high
140896	EulerOS 2.0 SP3 : gcc (EulerOS-SA-2020-2129)	Nessus	Huawei Local Security Checks	9/28/2020	2/19/2024	high
133976	EulerOS 2.0 SP8 : binutils (EulerOS-SA-2020-1142)	Nessus	Huawei Local Security Checks	2/25/2020	3/26/2024	high
136251	EulerOS Virtualization for ARM 64 3.0.2.0 : binutils (EulerOS-SA-2020-1548)	Nessus	Huawei Local Security Checks	5/1/2020	3/13/2024	high
203529	Photon OS 4.0: Crash PHSA-2023-4.0-0414	Nessus	PhotonOS Local Security Checks	7/23/2024	7/23/2024	critical
135150	EulerOS Virtualization for ARM 64 3.0.6.0 : binutils (EulerOS-SA-2020-1363)	Nessus	Huawei Local Security Checks	4/2/2020	3/20/2024	high
135628	EulerOS Virtualization 3.0.2.2 : binutils (EulerOS-SA-2020-1466)	Nessus	Huawei Local Security Checks	4/16/2020	3/15/2024	critical
137945	EulerOS Virtualization 3.0.6.0 : gcc (EulerOS-SA-2020-1726)	Nessus	Huawei Local Security Checks	7/1/2020	3/5/2024	high
140888	EulerOS 2.0 SP3 : gdb (EulerOS-SA-2020-2121)	Nessus	Huawei Local Security Checks	9/28/2020	2/19/2024	high
222206	Linux Distros Unpatched Vulnerability : CVE-2018-20657	Nessus	Misc.	3/4/2025	3/4/2025	high
130530	RHEL 8 : gdb (RHSA-2019:3352)	Nessus	Red Hat Local Security Checks	11/6/2019	11/6/2024	high
133895	EulerOS 2.0 SP5 : binutils (EulerOS-SA-2020-1094)	Nessus	Huawei Local Security Checks	2/24/2020	3/26/2024	high

Detections

Analytics

Plugins Search

high

critical

high

high

high

high

critical

high

critical

high

high

high

high

high