The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7259-2 advisory.

    USN-7259-1 fixed a vulnerability in GNU C Library. This update provides the corresponding update for     Ubuntu 16.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:0510-1 advisory.

    This update for glibc fixes the following issue:

    - CVE-2025-0395: Fix underallocation of abort_msg_s struct (bsc#1236282, BZ #32582))

    - s390x-wcsncmp patch: s390x: Fix segfault in wcsncmp (bsc#1228044).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-497995b101 advisory.

    This update addresses two security vulnerabilities:
    * CVE-2025-0395: A buffer overflow may occur in the `assert` function with certain large program names and     `assert` expressions.
    * CVE-2025-0577: getrandom, arc4random can produce predictable randomness if a multi-threaded program     creates additional threads after fork.
    The following non-security bugs are fixed:
    * Compatibility with certain programs that call `free(environ)` is improved (however, deallocating     `environ` remains undefined in general).
    * On certain non-Fedora kernels, `mkstemp` and other functions may not attempt to create multiple     different file names and fail with `EEXISTS`.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough     space for the assertion failure message string and size information, which may lead to a buffer overflow     if the message string size aligns to page size. (CVE-2025-0395)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:3828 advisory.

    * glibc: buffer overflow in the GNU C Library's assert() (CVE-2025-0395)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-3828 advisory.

    [2.28-251.0.3.16]
    - Forward port of Oracle patches       Reviewed-by: Elena Zannoni <elena.zannoni@oracle.com>       Oracle history:
      March-26-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.3.14
      - OraBug: 36625686 Add MTE support on string functions         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       March-17-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.14
      - Forward port of Oracle patches         Reviewed-by: David Faust <david.faust@oracle.com>       February-19-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.13
      - Forward port of Oracle patches         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       January-28-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.11
      - Forward port of Oracle patches         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       September-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.5
      - Forward port of Oracle patches over 2.28-251.5         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       August-26-2024 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.28-251.0.2.4
      - Forward port of Oracle patches over 2.28-251.4         Reviewed-by: David Faust <david.faust@oracle.com>       May-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.2
      - Forward port of Oracle patches over 2.28-251.2         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       May-23-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.1
      - Forward port of Oracle patches over 2.28-251.1         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       May-22-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2
      - Forward port of Oracle patches for ol8-u10         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       March-28-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.1
      - Forward port of Oracle patches for ol8-u10-beta         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       March-5-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-236.0.1.12
      - Forward port of Oracle patches.
        Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       November-14-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-236.0.1.7
      - Forward port of Oracle patches.
        Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       October-4-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-236.0.1.6
      - Forward port of Oracle patches.
        Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       April-21-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-225.0.3
      - OraBug 35317410 Glibc tunable to disable huge pages on pthread_create stacks
      - Created tunable glibc.pthread.stack_hugetlb to control when hugepages         can be used for stack allocation.
      - In case THP are enabled and glibc.pthread.stack_hugetlb is set to         0, glibc will madvise the kernel not to use allow hugepages for stack         allocations.
        Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       April-11-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-225.0.2
      - OraBug: 35268809 Fixed initialization of VDSO for tcache_key_initialize         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       March-28-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-225.0.1
      - Merge of Oracle patches for ol8u8 beta         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       September-28-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.28-211.0.1
      - Merge of Oracle patches for ol8u7 beta         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       August-8-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.28-189.5.0.2
      - Enable VDSO on x86_64, aarch64, i386, arm, and mips statically linked programs.
      - These changes enable reading the realtime clock without a kernel syscall.
        OraBug: 30478315         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       May-2-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.28-199.0.1
      - Merge of patches from c8s 199 with ol8u6 beta         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>
      - Update siginfo constants from linux kernel (OraBug: 33734528)
      - Remove limit on MALLOC_MMAP_THRESHOLD tunable (Orabug: 29630826)
      - Provide glibc.pthread.mutex_spin_count tunable for pthread adaptive
      - spin mutex (Orabug: 27982358)         Reviewed-by: Qing Zhao <qing.zhao@oracle.com>
      - add Ampere emag  to tunable cpu list (Patrick McGehearty)
      - add optimized memset for emag
      - add an ASIMD variant of strlen for falkor         Orabug: 2700101.
      - Modify glibc-ora28849085.patch so it works with RHCK kernels. (Orabug: 28849085)
      - Make _IO_funlockfile match __funlockfile and _IO_flockfile match __flockfile         Both should test           if (stream->_flags & _IO_USER_LOCK) == 0)
            _IO_lock_lock (*stream->_lock);
        OraBug: 28481550.
        Reviewed-by: Qing Zhao <qing.zhao@oracle.com>

    [2.28-251.16]
    - nscd: Fix an unlikely TTL issue in the netgroup cache (RHEL-35280)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0562-1 advisory.

    - CVE-2025-0395: Fix underallocation of abort_msg_s struct (bsc#1236282)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-69207650a4 advisory.

    This update addresses two security vulnerabilities:
    * CVE-2025-0395: A buffer overflow may occur in the `assert` function with certain large program names and     `assert` expressions.
    * CVE-2025-0577: getrandom, arc4random can produce predictable randomness if a multi-threaded program     creates additional threads after fork.
    The following non-security bugs are fixed:
    * Compatibility with certain programs that call `free(environ)` is improved (however, deallocating     `environ` remains undefined in general).
    * Crashes in string functions on certain hypervisors that report L3 cache sizes above 4 GiB are avoided.
    * Poor performance of x86-64 string functions in certain cases.
    * Initialization of the restartable sequence area now follows recommended practices.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7259-1 advisory.

    It was discovered that GNU C Library incorrectly handled memory when using the assert function. An     attacker could possibly use this issue to cause a denial of service or execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7259-3 advisory.

    USN-7259-1 fixed a vulnerability in GNU C Library. This update provides the corresponding update for     Ubuntu 14.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0582-1 advisory.

    - CVE-2025-0395: Fix underallocation of abort_msg_s struct (bsc#1236282)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of glibc installed on the remote host is prior to 2.26-64. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2828 advisory.

    When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough     space for the assertion failure message string and size information, which may lead to a buffer overflow     if the message string size aligns to page size. (CVE-2025-0395)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
215239	Ubuntu 16.04 LTS : GNU C Library vulnerability (USN-7259-2)	Nessus	Ubuntu Local Security Checks	2/10/2025	2/10/2025	high
216461	SUSE SLES12 Security Update : glibc (SUSE-SU-2025:0510-1)	Nessus	SuSE Local Security Checks	2/19/2025	2/19/2025	high
214654	Fedora 41 : glibc (2025-497995b101)	Nessus	Fedora Local Security Checks	1/27/2025	1/27/2025	high
231800	Linux Distros Unpatched Vulnerability : CVE-2025-0395	Nessus	Misc.	3/6/2025	3/6/2025	high
234346	AlmaLinux 8 : glibc (ALSA-2025:3828)	Nessus	Alma Linux Local Security Checks	4/15/2025	4/15/2025	high
234459	Oracle Linux 8 : glibc (ELSA-2025-3828)	Nessus	Oracle Linux Local Security Checks	4/16/2025	4/16/2025	high
216449	SUSE SLES15 Security Update : glibc (SUSE-SU-2025:0562-1)	Nessus	SuSE Local Security Checks	2/19/2025	2/19/2025	high
214653	Fedora 40 : glibc (2025-69207650a4)	Nessus	Fedora Local Security Checks	1/27/2025	1/27/2025	high
215062	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : GNU C Library vulnerability (USN-7259-1)	Nessus	Ubuntu Local Security Checks	2/6/2025	2/6/2025	high
215237	Ubuntu 14.04 LTS : GNU C Library vulnerability (USN-7259-3)	Nessus	Ubuntu Local Security Checks	2/10/2025	2/10/2025	high
216455	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : glibc (SUSE-SU-2025:0582-1)	Nessus	SuSE Local Security Checks	2/19/2025	2/19/2025	high
234526	Amazon Linux 2 : glibc (ALAS-2025-2828)	Nessus	Amazon Linux Local Security Checks	4/17/2025	4/17/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high

high