The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4954-1 advisory.

    Jason Royes and Samuel Dytrych discovered that the memcpy() implementation for 32 bit ARM processors in     the GNU C Library contained an integer underflow vulnerability. An attacker could possibly use this to     cause a denial of service (application crash) or execute arbitrary code. (CVE-2020-6096)

    It was discovered that the POSIX regex implementation in the GNU C Library did not properly parse     alternatives. An attacker could use this to cause a denial of service. (CVE-2009-5155)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses     alternatives, which allows attackers to cause a denial of service (assertion failure and application exit)     or trigger an incorrect result by attempting a regular-expression match. (CVE-2009-5155)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for glibc fixes the following issues :

Security issues fixed :

CVE-2019-9169: regex: fix read overrun (bsc#1127308, BZ #24114)

CVE-2016-10739: Fully parse IPv4 address strings (bsc#1122729, BZ #20018)

CVE-2009-5155: ERE '0|()0|\1|0' causes regexec undefined behavior (bsc#1127223, BZ #18986)

Non-security issues fixed: Enable TLE only if GLIBC_ELISION_ENABLE=yes is defined (bsc#1131994, fate#322271)

Add more checks for valid ld.so.cache file (bsc#1110661, BZ #18093)

Added cfi information for start routines in order to stop unwinding (bsc#1128574)

ja_JP locale: Add entry for the new Japanese era (bsc#1100396, fate#325570, BZ #22964)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K64119434 advisory.

    In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses     alternatives, which allows attackers to cause a denial of service (assertion failure and application exit)     or trigger an incorrect result by attempting a regular-expression match.(CVE-2009-5155)ImpactAn attacker     can exploit this vulnerability to cause a denial-of-service (DoS) on the affected system.

Tenable has extracted the preceding description block directly from the F5 Networks BIG-IP security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In the GNU C Library (aka glibc or libc6) before 2.28,     parse_reg_exp in posix/regcomp.c misparses     alternatives, which allows attackers to cause a denial     of service (assertion failure and application exit) or     trigger an incorrect result by attempting a     regular-expression match.(CVE-2009-5155)

  - In the GNU C Library (aka glibc or libc6) through 2.29,     proceed_next_node in posix/regexec.c has a heap-based     buffer over-read via an attempted case-insensitive     regular-expression match.(CVE-2019-9169)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for glibc fixes the following issues :

Security issues fixed :

  - CVE-2019-9169: Fixed a heap-based buffer over-read via     an attempted case-insensitive regular-expression match     (bsc#1127308).

  - CVE-2009-5155: Fixed a denial of service in     parse_reg_exp() (bsc#1127223).

Non-security issues fixed :

  - Does no longer compress debug sections in crt*.o files     (bsc#1123710)

  - Fixes a concurrency problem in ldconfig (bsc#1117993)

  - Fixes a race condition in pthread_mutex_lock while     promoting to PTHREAD_MUTEX_ELISION_NP (bsc#1131330)

This update was imported from the SUSE:SLE-15:Update update project.

This update for glibc fixes the following issues :

Security issues fixed :

CVE-2019-9169: Fixed a heap-based buffer over-read via an attempted case-insensitive regular-expression match (bsc#1127308).

CVE-2009-5155: Fixed a denial of service in parse_reg_exp() (bsc#1127223).

Non-security issues fixed: Added cfi information for start routines in order to stop unwinding on S390 (bsc#1128574).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the glibc package has been released.

This update for glibc fixes the following issues :

Security issues fixed :

CVE-2019-9169: Fixed a heap-based buffer over-read via an attempted case-insensitive regular-expression match (bsc#1127308).

CVE-2009-5155: Fixed a denial of service in parse_reg_exp() (bsc#1127223).

Non-security issues fixed: Does no longer compress debug sections in crt*.o files (bsc#1123710)

Fixes a concurrency problem in ldconfig (bsc#1117993)

Fixes a race condition in pthread_mutex_lock while promoting to PTHREAD_MUTEX_ELISION_NP (bsc#1131330)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of glibc installed on the remote host is prior to 2.26-62. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1869 advisory.

    In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses     alternatives, which allows attackers to cause a denial of service (assertion failure and application exit)     or trigger an incorrect result by attempting a regular-expression match. (CVE-2009-5155)

    The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers     to cause a denial of service (assertion failure and application crash) via vectors related to extended     regular expression processing. (CVE-2015-8985)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
149477	Ubuntu 16.04 LTS : GNU C Library vulnerabilities (USN-4954-1)	Nessus	Ubuntu Local Security Checks	5/14/2021	8/27/2024	high
217111	Linux Distros Unpatched Vulnerability : CVE-2009-5155	Nessus	Misc.	3/3/2025	3/3/2025	high
124451	SUSE SLED12 / SLES12 Security Update : glibc (SUSE-SU-2019:1102-1)	Nessus	SuSE Local Security Checks	5/1/2019	5/30/2024	critical
165258	F5 Networks BIG-IP : GNU C Library vulnerability (K64119434)	Nessus	F5 Networks Local Security Checks	9/20/2022	3/27/2025	high
123585	EulerOS 2.0 SP2 : glibc (EulerOS-SA-2019-1111)	Nessus	Huawei Local Security Checks	4/2/2019	6/6/2024	critical
127035	openSUSE Security Update : glibc (openSUSE-2019-1798)	Nessus	SuSE Local Security Checks	7/25/2019	5/8/2024	critical
128018	SUSE SLES12 Security Update : glibc (SUSE-SU-2019:1958-2)	Nessus	SuSE Local Security Checks	8/20/2019	5/2/2024	critical
125393	Photon OS 2.0: Glibc PHSA-2019-2.0-0160	Nessus	PhotonOS Local Security Checks	5/28/2019	7/22/2024	high
126812	SUSE SLED15 / SLES15 Security Update : glibc (SUSE-SU-2019:1877-1)	Nessus	SuSE Local Security Checks	7/19/2019	5/9/2024	critical
123609	EulerOS 2.0 SP5 : glibc (EulerOS-SA-2019-1135)	Nessus	Huawei Local Security Checks	4/2/2019	6/6/2024	critical
126986	SUSE SLES12 Security Update : glibc (SUSE-SU-2019:1958-1)	Nessus	SuSE Local Security Checks	7/24/2019	5/8/2024	critical
167239	Amazon Linux 2 : glibc (ALAS-2022-1869)	Nessus	Amazon Linux Local Security Checks	11/9/2022	12/11/2024	high

Detections

Analytics

Plugins Search

high

high

critical

high

critical

critical

critical

high

critical

critical

critical

high