An update of the libxml2 package has been released.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-4862425658 advisory.

    Update to 2.12.7 (RHBZ#2280535, CVE-2024-34459)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-783 advisory.

    An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error     messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.
    (CVE-2024-34459)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error     messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in     xmllint.c.(CVE-2024-34459)

Tenable has extracted the preceding description block directly from the EulerOS libxml2 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2717 advisory.

    An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error     messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.
    (CVE-2024-34459)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7240-1 advisory.

    It was discovered that libxml2 incorrectly handled certain memory operations. A remote attacker could use     this issue to cause libxml2 to crash, resulting in a denial of service, or possibly execute arbitrary     code. (CVE-2022-49043)

    It was discovered that the libxml2 xmllint tool incorrectly handled certain memory operations. If a user     or automated system were tricked into running xmllint on a specially crafted xml file, a remote attacker     could cause xmllint to crash, resulting in a denial of service. (CVE-2024-34459)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4251 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4251-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     July 26, 2025                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libxml2     Version        : 2.9.10+dfsg-6.7+deb11u8     CVE ID         : CVE-2024-34459 CVE-2025-6021 CVE-2025-6170 CVE-2025-49794                      CVE-2025-49796     Debian Bug     : 1071162 1107720 1107755 1107938

    Multiple security issues were found in libxml2, the GNOME XML library,     which could yield to denial of service or potentially arbitrary code     execution.

    CVE-2024-34459

        Zhineng Zhong discovered that formatting error messages with `xmllint
        --htmlout` could result in a buffer over-read.

    CVE-2025-6021

        Ahmed Lekssays discovered an integer overflow issue in         `xmlBuildQName()` which could result in memory corruption or a         denial of service when processing crafted input.

    CVE-2025-6170

        Ahmed Lekssays discovered a stack-based buffer overflow issue in the         command-parsing logic of the interactive shell in xmllint.

    CVE-2025-49794

        Nikita Sveshnikov discovered a heap use-after-free issue in the         schematron.  When processing XPath expressions in Schematron schema         elements `<sch:name path=/>`, a pointer to freed memory is         returned and then accessed, leading to undefined behavior or         potential crashes.

    CVE-2025-49796

        Nikita Sveshnikov discovered a type confusion issue in the         schematron.  Processing `sch:name` elements and accessing namespace         information may lead to leading to memory corruption or undefined         behavior.

    For Debian 11 bullseye, these problems have been fixed in version     2.9.10+dfsg-6.7+deb11u8.

    We recommend that you upgrade your libxml2 packages.

    For the detailed security status of libxml2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libxml2

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-9ffc6cc7bf advisory.

    Update to 2.12.7 (RHBZ#2280535, CVE-2024-34459)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libxml2 installed on the remote host is prior to 2.11.8 / 2.12.7. It is, therefore, affected by a vulnerability as referenced in the SSA:2024-134-01 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error     messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in     xmllint.c.(CVE-2024-34459)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libxml2 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7302-1 advisory.

    It was discovered that libxml2 incorrectly handled certain memory operations. A remote attacker could use     this issue to cause libxml2 to crash, resulting in a denial of service, or possibly execute arbitrary     code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2022-49043)

    It was discovered that the libxml2 xmllint tool incorrectly handled certain memory operations. If a user     or automated system were tricked into running xmllint on a specially crafted xml file, a remote attacker     could cause xmllint to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS,     Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2024-34459)

    It was discovered that libxml2 did not properly manage memory. An attacker could possibly use this issue     to cause a denial of service or execute arbitrary code. (CVE-2024-56171)

    It was discovered that libxml2 could be made to write out of bounds. An attacker could possibly use this     issue to cause a denial of service or execute arbitrary code. (CVE-2025-24928)

    It was discovered that libxml2 could be made to dereference invalid memory. An attacker could possibly use     this issue to cause a denial of service. (CVE-2025-27113)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
203565	Photon OS 4.0: Libxml2 PHSA-2024-4.0-0640	Nessus	PhotonOS Local Security Checks	2024/7/23	2025/2/21	high
197915	Fedora 39 : mingw-libxml2 (2024-4862425658)	Nessus	Fedora Local Security Checks	2024/5/25	2024/8/23	high
212356	Amazon Linux 2023 : libxml2, libxml2-devel, libxml2-static (ALAS2023-2024-783)	Nessus	Amazon Linux Local Security Checks	2024/12/11	2025/2/21	high
208369	EulerOS 2.0 SP12 : libxml2 (EulerOS-SA-2024-2534)	Nessus	Huawei Local Security Checks	2024/10/9	2025/2/21	high
213363	Amazon Linux 2 : libxml2 (ALAS-2024-2717)	Nessus	Amazon Linux Local Security Checks	2024/12/23	2025/2/21	high
214777	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : libxml2 vulnerabilities (USN-7240-1)	Nessus	Ubuntu Local Security Checks	2025/1/29	2025/2/21	high
242881	Debian dla-4251 : libxml2 - security update	Nessus	Debian Local Security Checks	2025/7/27	2025/7/27	low
197912	Fedora 40 : mingw-libxml2 (2024-9ffc6cc7bf)	Nessus	Fedora Local Security Checks	2024/5/25	2024/8/23	high
196908	Slackware Linux 15.0 / current libxml2 Vulnerability (SSA:2024-134-01)	Nessus	Slackware Local Security Checks	2024/5/13	2024/8/23	high
206339	Photon OS 3.0: Libxml2 PHSA-2024-3.0-0787	Nessus	PhotonOS Local Security Checks	2024/8/30	2025/2/21	high
209782	EulerOS Virtualization 2.12.0 : libxml2 (EulerOS-SA-2024-2773)	Nessus	Huawei Local Security Checks	2024/10/27	2025/2/21	high
209796	EulerOS Virtualization 2.12.1 : libxml2 (EulerOS-SA-2024-2755)	Nessus	Huawei Local Security Checks	2024/10/27	2025/2/21	high
205971	EulerOS Virtualization 2.11.1 : libxml2 (EulerOS-SA-2024-2158)	Nessus	Huawei Local Security Checks	2024/8/21	2025/2/21	high
216780	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : libxml2 vulnerabilities (USN-7302-1)	Nessus	Ubuntu Local Security Checks	2025/2/25	2025/4/10	high

偵測

搜尋 Plugin

high

high

high

high

high

high

low

high

high

high

high

high

high

high