libxml2 version 2.7.0 and 2.7.1 did not properly handle predefined entities definitions in entities, which allowed context-dependent attackers to cause a denial of service (memory consumption and application crash) via certain XML documents (CVE-2008-4409).

The updated packages have been patched to prevent this issue.

The remote host is affected by the vulnerability described in GLSA-200812-06 (libxml2: Multiple vulnerabilities)

    Multiple vulnerabilities were reported in libxml2:
    Andreas Solberg reported that libxml2 does not properly detect     recursion during entity expansion in an attribute value     (CVE-2008-3281).
    A heap-based buffer overflow has been reported in the     xmlParseAttValueComplex() function in parser.c (CVE-2008-3529).
    Christian Weiske reported that predefined entity definitions in     entities are not properly handled (CVE-2008-4409).
    Drew Yao of Apple Product Security reported an integer overflow in the     xmlBufferResize() function that can lead to an infinite loop     (CVE-2008-4225).
    Drew Yao of Apple Product Security reported an integer overflow in the     xmlSAX2Characters() function leading to a memory corruption     (CVE-2008-4226).
  Impact :

    A remote attacker could entice a user or automated system to open a     specially crafted XML document with an application using libxml2,     possibly resulting in the exeution of arbitrary code or a high CPU and     memory consumption.
  Workaround :

    There is no known workaround at this time.

This is an urgent security fix for a bug newly introduced in libxml2-2.7.x leading to CPU and memory exhaustion. See upstream bug report for further details:
https://bugzilla.gnome.org/show_bug.cgi?id=554660

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Apple Safari installed on the remote Mac OS X host is earlier than 4.0.  As such, it is potentially affected by numerous issues in the following components :

  - CFNetwork
  - libxml
  - Safari
  - WebKit

The version of Safari installed on the remote Windows host is earlier than 4.0.  It therefore is potentially affected by numerous issues in the following components :

  - CFNetwork
  - CoreGraphics
  - ImageIO
  - International Components for Unicode
  - libxml
  - Safari
  - Safari Windows Installer
  - WebKit

ID	名稱	產品	系列	已發布	已更新	嚴重性
36844	Mandriva Linux Security Advisory : libxml2 (MDVSA-2008:212)	Nessus	Mandriva Local Security Checks	2009/4/23	2021/1/6	medium
35023	GLSA-200812-06 : libxml2: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2008/12/3	2021/1/6	critical
34342	Fedora 8 : libxml2-2.7.1-2.fc8 (2008-8582)	Nessus	Fedora Local Security Checks	2008/10/6	2021/1/11	medium
39338	Mac OS X : Apple Safari < 4.0	Nessus	MacOS X Local Security Checks	2009/6/9	2018/7/14	high
34341	Fedora 9 : libxml2-2.7.1-2.fc9 (2008-8575)	Nessus	Fedora Local Security Checks	2008/10/6	2021/1/11	medium
39339	Safari < 4.0 Multiple Vulnerabilities	Nessus	Windows	2009/6/9	2018/7/27	high

偵測

搜尋 Plugin

medium

critical

medium

high

medium

high