The version of Tenable Log Correlation Engine (LCE) installed on the remote host is a version prior to 4.8.0. It is, therefore, affected by a denial of service vulnerability in the bundled version of Libxml2 due to an infinite loop condition in the xz_decomp() function. An unauthenticated, remote attacker can exploit this by convincing a user to input specially crafted XML content, to exhaust available system resources, resulting in a denial of service condition.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1190 advisory.

  - The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which     allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.
    (CVE-2015-8035)

  - Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82,     allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors     related to the XPointer range-to function. (CVE-2016-5131)

  - Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products,     allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2017-15412)

  - The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of     service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict     memory usage to what is required for a legitimate file. (CVE-2017-18258)

  - A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2     through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case.
    Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable     to a denial of service attack due to a crash of the application. (CVE-2018-14404)

  - libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite     loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different     vulnerability than CVE-2015-8035 and CVE-2018-9251. (CVE-2018-14567)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libxml2 packages installed that are affected by multiple vulnerabilities:

  - Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82,     allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors     related to the XPointer range-to function. (CVE-2016-5131)

  - Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products,     allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2017-15412)

  - A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2     through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case.
    Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable     to a denial of service attack due to a crash of the application. (CVE-2018-14404)

  - libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite     loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different     vulnerability than CVE-2015-8035 and CVE-2018-9251. (CVE-2018-14567)

  - The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of     service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict     memory usage to what is required for a legitimate file. (CVE-2017-18258)

  - The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which     allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.
    (CVE-2015-8035)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-016:01 advisory.

    * libxml2: Use after free triggered by XPointer paths beginning with range-to (CVE-2016-5131)
      * libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate() function in xpath.c     (CVE-2017-15412)
      * libxml2: DoS caused by incorrect error detection during XZ decompression (CVE-2015-8035)
      * libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c (CVE-2018-14404)
      * libxml2: Unrestricted memory usage in xz_head() function in xzlib.c (CVE-2017-18258)
      * libxml2: Infinite loop caused by incorrect error detection during LZMA decompression (CVE-2018-14567)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- update to 2.9.3

  - full changelog: http://www.xmlsoft.org/news.html

  - fixed CVEs: CVE-2015-8242, CVE-2015-7500, CVE-2015-7499,     CVE-2015-5312, CVE-2015-7497, CVE-2015-7498,     CVE-2015-8035, CVE-2015-7942, CVE-2015-1819,     CVE-2015-7941, CVE-2014-3660, CVE-2014-0191,     CVE-2015-8241, CVE-2015-8317

  - fixed bugs: [bsc#928193], [bsc#951734], [bsc#951735],     [bsc#954429], [bsc#956018], [bsc#956021], [bsc#956260],     [bsc#957105], [bsc#957106], [bsc#957107], [bsc#957109],     [bsc#957110]

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2812-1 advisory.

    Florian Weimer discovered that libxml2 incorrectly handled certain XML data. If a user or automated system     were tricked into opening a specially crafted document, an attacker could possibly cause resource     consumption, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS     and Ubuntu 15.04. (CVE-2015-1819)

    Michal Zalewski discovered that libxml2 incorrectly handled certain XML data. If a user or automated     system were tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to     crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and     Ubuntu 15.04. (CVE-2015-7941)

    Kostya Serebryany discovered that libxml2 incorrectly handled certain XML data. If a user or automated     system were tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to     crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-7942)

    Gustavo Grieco discovered that libxml2 incorrectly handled certain XML data. If a user or automated system     were tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to crash,     resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-8035)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.17.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.17.1 advisory.

  - When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to     Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP     connection. If such connections are available to an attacker, they can be exploited in ways that may be     surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped     with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected     (and recommended in the security guide) that this Connector would be disabled if not required. This     vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the     web application - processing any file in the web application as a JSP Further, if the web application     allowed file upload and stored those files within the web application (or the attacker was able to control     the content of the web application by some other means) then this, along with the ability to process a     file as a JSP, made remote code execution possible. It is important to note that mitigation is only     required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth     approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to     Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP     Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading     to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
    (CVE-2020-1938)

  - rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a     certain upper-bound check, leading to a buffer overflow. (CVE-2019-17666)

  - The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-     free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can     occur with FUSE requests. (CVE-2019-11487)

  - A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where,     the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error     occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by     the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction     mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism     to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that     host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.
    (CVE-2019-19338)

  - The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which     allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.
    (CVE-2015-8035)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mac OS X that is 10.9.5 or 10.10.5 and is missing Security Update 2016-002. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache_mod_php
  - Kernel
  - libxml2
  - OpenSSH
  - Python
  - Tcl

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

According to its banner, the remote Apple TV device is a version prior to 9.2. It is, therefore, affected by the following vulnerabilities :

  - An XML external entity (XXE) expansion flaw exists in     libxml2 due to the XML parser accepting entities from     untrusted sources. An unauthenticated, remote attacker     can exploit this, via crafted XML data, to cause a     denial of service through resource exhaustion.
    (CVE-2015-1819)

  - An XML external entity (XXE) injection flaw exists in     libxml2 in file parser.c due to the XML parser accepting     entities from untrusted sources. An unauthenticated,     remote attacker can exploit this, via crafted XML data,     to cause a denial of service or to disclose sensitive     information. (CVE-2015-5312)

  - A heap buffer overflow condition exists in libxml2 in     the xmlGROW() function within file parser.c while     handling XML data. An unauthenticated, remote attacker     can exploit this to disclose sensitive information.
    (CVE-2015-7499)

  - An out-of-bounds heap read error exists in libxml2 in     the xmlParseMisc() function within file parser.c while     handling entity boundaries. An unauthenticated, remote     attacker can exploit this to cause a denial of service.
    (CVE-2015-7500)

  - An out-of-bounds read error exists in libxml2 in the     xmlParseConditionalSections() function within file     parser.c due to a failure to properly skip intermediary     entities when it stops parsing invalid input. An     unauthenticated, remote attacker can exploit this, via     crafted XML data, to cause a denial of service.
    (CVE-2015-7942)

  - A flaw exists in libxml2 in the xz_decomp() function     within file xzlib.c due to a failure to properly detect     compression errors when handling compressed XML content.
    An unauthenticated, remote attacker can exploit this,     via crafted XML data, to cause an infinite loop,     resulting in a denial of service.
    (CVE-2015-8035)

  - A out-of-bounds read error exists in libxml2 in the     xmlSAX2TextNode() function within file SAX2.c due to     improper sanitization of input data. An unauthenticated,     remote attacker can exploit this, via crafted XML data,     to cause a denial of service or to disclose sensitive     information. (CVE-2015-8242)

  - A use-after-free error exists in Nghttp2 within file     lib/nghttp2_session.c when handling idle streams. An     unauthenticated, remote attacker can exploit this to     deference already freed memory, allowing the execution     of arbitrary code. (CVE-2015-8659)

  - An overflow condition exists in the Broadcom Wi-Fi     driver due to improper validation of data while handling     SSID or WPS_ID_DEVICE_NAME values. An unauthenticated,     adjacent attacker can exploit this, via a crafted     wireless control message packet, to cause a denial of     service or to execute arbitrary code. (CVE-2016-0801)

  - An overflow condition exists in the Broadcom Wi-Fi     driver due to improper validation of user-supplied     input when handling the packet length of event messages.
    An unauthenticated, adjacent attacker can exploit this,     via a crafted wireless control message packet, to cause     a denial of service or to execute arbitrary code.
    (CVE-2016-0802)

  - A flaw exists in FontParser due to improper validation     of user-supplied input when handling encoded fonts that     contain invalid characters. An unauthenticated, remote     attacker can exploit this, via a crafted PDF document,     to corrupt memory, resulting in a denial of service or     the execution arbitrary code. (CVE-2016-1740)

  - A flaw exists in IOHIDFamily due to improper validation     of user-supplied input. An unauthenticated, remote     attacker can exploit this, via a crafted application,     to gain access to kernel memory layout information.
    (CVE-2016-1748)

  - A use-after-free error exists in the kernel that allows     an unauthenticated, remote attacker to execute arbitrary     code via a crafted application. (CVE-2016-1750)

  - A flaw exists in the kernel due to a failure to properly     restrict execution permissions. An unauthenticated,     remote attacker can exploit this, via a crafted     application, to bypass code-signing protection     mechanisms. (CVE-2016-1751)

  - An unspecified flaw exists in the kernel that allows a     local attacker to cause a denial of service via a     crafted application. (CVE-2016-1752)

  - An integer overflow condition exists in the kernel due     to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this, via     a crafted application, to gain elevated privileges.
    (CVE-2016-1753)

  - A memory corruption issue exists in the kernel due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this, by     convincing a user to install a malicious application,     to cause a denial of service or execute arbitrary code.
    CVE-2016-1754)

  - A use-after-free error exists in the AppleKeyStore user     client when handling multiple threads, which is     triggered when one thread closes the user client while     another attempts to call an external method. An     unauthenticated, remote attacker can exploit this, by     convincing a user to install a malicious application, to     execute arbitrary code with elevated privileges.
    (CVE-2016-1755)

  - A flaw exists in libxml2 due to improper validation of     user-supplied input while handling XML content. An     unauthenticated, remote attacker can exploit this, via a     crafted XML document, to cause a denial of service or to     execute arbitrary code. (CVE-2016-1762)

  - An out-of-bounds write error exists in TrueTypeScaler     due to improper validation of user-supplied input while     handling bdat tables in TTF fonts. An unauthenticated,     remote attacker can exploit this, via a crafted TTF     font, to cause a denial or service or to execute     arbitrary code. (CVE-2016-1775)

  - A flaw exists in WebKit due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this, via a crafted website, to cause a     denial of service or execute arbitrary code.
    (CVE-2016-1783)

  - An unspecified flaw exists in the History implementation     of WebKit that allows an unauthenticated, remote     attacker to cause a denial of service via a crafted     website. (CVE-2016-1784)

  - A heap buffer overflow condition exists in Mozilla     Network Security Services due to improper validation of     user-supplied input while parsing ASN.1 structures. An     unauthenticated, remote attacker can exploit this, via     crafted ASN.1 data in an X.509 certificate, to cause a     denial of service or execute arbitrary code.
    (CVE-2016-1950)

Note that only 4th generation models are affected by these vulnerabilities, and this plugin only checks these models.

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A remote code execution vulnerability in libxml2 could     enable an attacker using a specially crafted file to     execute arbitrary code within the context of an     unprivileged process. This issue is rated as High due     to the possibility of remote code execution in an     application that uses this library. Product: Android.
    Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1,     7.1.2. Android ID: A-37104170.(CVE-2017-0663)

  - libxml2 2.9.8, if --with-lzma is used, allows remote     attackers to cause a denial of service (infinite loop)     via a crafted XML file that triggers     LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a     different vulnerability than CVE-2015-8035 and     CVE-2018-9251.(CVE-2018-14567)

  - The htmlParseTryOrFinish function in HTMLparser.c in     libxml2 2.9.4 allows attackers to cause a denial of     service (buffer over-read) or information     disclosure.(CVE-2017-8872)

  - libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a     stack-based buffer overflow. The function     xmlSnprintfElementContent in valid.c is supposed to     recursively dump the element content definition into a     char buffer 'buf' of size 'size'. At the end of the     routine, the function may strcat two more characters     without checking whether the current strlen(buf) + 2 <     size. This vulnerability causes programs that use     libxml2, such as PHP, to crash.(CVE-2017-9048)

  - The xz_decomp function in xzlib.c in libxml2 2.9.1 does     not properly detect compression errors, which allows     context-dependent attackers to cause a denial of     service (process hang) via crafted XML     data.(CVE-2015-8035)

  - The xz_head function in xzlib.c in libxml2 before 2.9.6     allows remote attackers to cause a denial of service     (memory consumption) via a crafted LZMA file, because     the decoder functionality does not restrict memory     usage to what is required for a legitimate     file.(CVE-2017-18258)

  - ** DISPUTED ** libxml2 2.9.4, when used in recover     mode, allows remote attackers to cause a denial of     service (NULL pointer dereference) via a crafted XML     document. NOTE: The maintainer states 'I would disagree     of a CVE with the Recover parsing option which should     only be used for manual recovery at least for XML     parser.'(CVE-2017-5969)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - This library allows to manipulate XML files. It     includes support to read, modify and write XML and HTML     files. There is DTDs support this includes parsing and     validation even with complex DtDs, either at parse time     or later once the document has been modified. The     output can be a simple SAX stream or and in-memory DOM     like representations. In this case one can use the     built-in XPath and XPointer implementation to select     sub nodes or ranges. A flexible Input/Output mechanism     is available, with existing HTTP and FTP modules and     combined to an URI library.Security Fix(es):** DISPUTED
    ** libxml2 2.9.4, when used in recover mode, allows     remote attackers to cause a denial of service (NULL     pointer dereference) via a crafted XML document. NOTE:
    The maintainer states 'I would disagree of a CVE with     the Recover parsing option which should only be used     for manual recovery at least for XML     parser.'(CVE-2017-5969)A NULL pointer dereference     vulnerability exists in the     xpath.c:xmlXPathCompOpEval() function of libxml2     through 2.9.8 when parsing an invalid XPath expression     in the XPATH_OP_AND or XPATH_OP_OR case. Applications     processing untrusted XSL format inputs with the use of     the libxml2 library may be vulnerable to a denial of     service attack due to a crash of the     application.(CVE-2018-14404)libxml2 2.9.8, if
    --with-lzma is used, allows remote attackers to cause a     denial of service (infinite loop) via a crafted XML     file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated     by xmllint, a different vulnerability than     CVE-2015-8035 and CVE-2018-9251.(CVE-2018-14567)libxml2     20904-GITv2.9.4-16-g0741801 is vulnerable to a     heap-based buffer over-read in the     xmlDictComputeFastKey function in dict.c. This     vulnerability causes programs that use libxml2, such as     PHP, to crash. This vulnerability exists because of an     incomplete fix for libxml2 Bug     759398.(CVE-2017-9049)libxml2     20904-GITv2.9.4-16-g0741801 is vulnerable to a     stack-based buffer overflow. The function     xmlSnprintfElementContent in valid.c is supposed to     recursively dump the element content definition into a     char buffer 'buf' of size 'size'. At the end of the     routine, the function may strcat two more characters     without checking whether the current strlen(buf) + 2 <     size. This vulnerability causes programs that use     libxml2, such as PHP, to crash.(CVE-2017-9048)The     htmlParseTryOrFinish function in HTMLparser.c in     libxml2 2.9.4 allows attackers to cause a denial of     service (buffer over-read) or information     disclosure.(CVE-2017-8872)The xz_decomp function in     xzlib.c in libxml2 2.9.1 does not properly detect     compression errors, which allows context-dependent     attackers to cause a denial of service (process hang)     via crafted XML data.(CVE-2015-8035)The xz_head     function in xzlib.c in libxml2 before 2.9.6 allows     remote attackers to cause a denial of service (memory     consumption) via a crafted LZMA file, because the     decoder functionality does not restrict memory usage to     what is required for a legitimate file.(CVE-2017-18258)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - This library allows to manipulate XML files. It     includes support to read, modify and write XML and HTML     files. There is DTDs support this includes parsing and     validation even with complex DtDs, either at parse time     or later once the document has been modified. The     output can be a simple SAX stream or and in-memory DOM     like representations.In this case one can use the     built-in XPath and XPointer implementation to select     sub nodes or ranges. A flexible Input/Output mechanism     is available, with existing HTTP and FTP modules and     combined to an URI library.

  - Security Fixi1/4^esi1/4%0:

  - Multiple integer overflows in libxml2, as used in     Google Chrome before 20.0.1132.43 and other products,     on 64-bit Linux platforms allow remote attackers to     cause a denial of service or possibly have unspecified     other impact via unknown vectors.i1/4^CVE-2012-2807i1/4%0

  - A denial of service flaw was found in libxml2. A remote     attacker could provide a specially crafted XML or HTML     file that, when processed by an application using     libxml2, would cause that application to     crash.i1/4^CVE-2015-8035i1/4%0

  - The xz_head function in xzlib.c in libxml2 before 2.9.6     allows remote attackers to cause a denial of service     i1/4^memory consumptioni1/4%0 via a crafted LZMA file,     because the decoder functionality does not restrict     memory usage to what is required for a legitimate     file.i1/4^CVE-2017-18258i1/4%0

  - A NULL pointer dereference vulnerability exists in the     xpath.c:xmlXPathCompOpEvali1/4^i1/4%0 function of libxml2     through 2.9.8 when parsing an invalid XPath expression     in the XPATH_OP_AND or XPATH_OP_OR case. Applications     processing untrusted XSL format inputs with the use of     the libxml2 library may be vulnerable to a denial of     service attack due to a crash of the     application.i1/4^CVE-2018-14404i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of libxml2 installed on the remote host is prior to 2.9.1-6.4.40. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1415 advisory.

    A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2     through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case.
    Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable     to a denial of service attack due to a crash of the application. A null pointer dereference vulnerability     exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 when parsing invalid XPath expression.
    Applications processing untrusted XSL format inputs with the use of libxml2 library may be vulnerable to     denial of service attack due to crash of the application. (CVE-2018-14404)

    Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products,     allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. A use-after-free     flaw was found in the libxml2 library. An attacker could use this flaw to cause an application linked     against libxml2 to crash when parsing a specially crafted XML file. (CVE-2017-15412)

    The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which     allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data. A     denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or     HTML file that, when processed by an application using libxml2, would cause that application to crash.
    (CVE-2015-8035)

    libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite     loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different     vulnerability thanCVE-2015-8035andCVE-2018-9251. (CVE-2018-14567)

    The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of     service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict     memory usage to what is required for a legitimate file. (CVE-2017-18258)

    Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82,     allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors     related to the XPointer range-to function. (CVE-2016-5131)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libxml2 packages installed that are affected by multiple vulnerabilities:

  - Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82,     allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors     related to the XPointer range-to function. (CVE-2016-5131)

  - Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products,     allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2017-15412)

  - A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2     through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case.
    Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable     to a denial of service attack due to a crash of the application. (CVE-2018-14404)

  - libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite     loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different     vulnerability than CVE-2015-8035 and CVE-2018-9251. (CVE-2018-14567)

  - The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of     service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict     memory usage to what is required for a legitimate file. (CVE-2017-18258)

  - The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which     allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.
    (CVE-2015-8035)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially sensitive information, or crash the application.

The remote host is running a version of Mac OS X that is 10.11.x prior to 10.11.4. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache_mod_php
  - AppleRAID
  - AppleUSBNetworking
  - Bluetooth
  - Carbon
  - dyld
  - FontParser
  - HTTPProtocol
  - Intel Graphics Driver
  - IOFireWireFamily
  - IOGraphics
  - IOHIDFamily
  - IOUSBFamily
  - Kernel
  - libxml2
  - Messages
  - NVIDIA Graphics Drivers
  - OpenSSH
  - OpenSSL
  - Python
  - QuickTime
  - Reminders
  - Ruby
  - Security
  - Tcl
  - TrueTypeScaler
  - Wi-Fi

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	名稱	產品	系列	已發布	已更新	嚴重性
90706	Tenable Log Correlation Engine (LCE) < 4.8.0 Libxml2 DoS	Nessus	Misc.	2016/4/25	2021/10/25	medium
135358	CentOS 7 : libxml2 (RHSA-2020:1190)	Nessus	CentOS Local Security Checks	2020/4/10	2024/10/9	high
143906	NewStart CGSL CORE 5.04 / MAIN 5.04 : libxml2 Multiple Vulnerabilities (NS-SA-2020-0060)	Nessus	NewStart CGSL Local Security Checks	2020/12/9	2024/2/5	high
291688	MiracleLinux 7 : libxml2-2.9.1-6.4.0.1.el7.AXS7 (AXSA:2020-016:01)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	high
87631	openSUSE Security Update : libxml2 (openSUSE-2015-959)	Nessus	SuSE Local Security Checks	2015/12/29	2021/1/19	high
86897	Ubuntu 14.04 LTS : libxml2 vulnerabilities (USN-2812-1)	Nessus	Ubuntu Local Security Checks	2015/11/17	2025/9/3	critical
164612	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.17.1)	Nessus	Misc.	2022/9/1	2025/9/1	critical
90097	Mac OS X 10.9.5 / 10.10.5 Multiple Vulnerabilities (Security Update 2016-002)	Nessus	MacOS X Local Security Checks	2016/3/22	2024/5/28	critical
90309	Apple TV < 9.2 Multiple Vulnerabilities	Nessus	Misc.	2016/4/1	2019/11/19	critical
131644	EulerOS 2.0 SP2 : libxml2 (EulerOS-SA-2019-2491)	Nessus	Huawei Local Security Checks	2019/12/4	2024/4/8	critical
132161	EulerOS 2.0 SP3 : libxml2 (EulerOS-SA-2019-2626)	Nessus	Huawei Local Security Checks	2019/12/18	2024/4/3	critical
125103	EulerOS Virtualization 3.0.1.0 : libxml2 (EulerOS-SA-2019-1559)	Nessus	Huawei Local Security Checks	2019/5/15	2024/5/22	high
139549	Amazon Linux AMI : libxml2 (ALAS-2020-1415)	Nessus	Amazon Linux Local Security Checks	2020/8/13	2024/12/11	high
143920	NewStart CGSL CORE 5.05 / MAIN 5.05 : libxml2 Multiple Vulnerabilities (NS-SA-2020-0091)	Nessus	NewStart CGSL Local Security Checks	2020/12/9	2024/2/5	high
87608	Debian DSA-3430-1 : libxml2 - security update	Nessus	Debian Local Security Checks	2015/12/29	2021/1/11	critical
90096	Mac OS X 10.11.x < 10.11.4 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2016/3/22	2024/5/28	critical

偵測

搜尋 Plugin

medium

high

high

high

high

critical

critical

critical

critical

critical

critical

high

high

high

critical

critical