A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information.(CVE-2015-8242)

A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash.(CVE-2015-7500)

A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information.(CVE-2015-8317)

A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash.(CVE-2015-7497)

A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash.(CVE-2015-7498)

A denial of service flaw was found in the way the libxml2 library parsed certain XML files. An attacker could provide a specially crafted XML file that, when parsed by an application using libxml2, could cause that application to use an excessive amount of memory.(CVE-2015-1819)

A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash.(CVE-2015-7941)

A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information.(CVE-2015-7499)

A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information.(CVE-2015-8241)

A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU.(CVE-2015-5312)

A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an application linked against libxml2, would cause the application to crash causing a denial of service.(CVE-2015-7942)

It was discovered that libxml2 could access out-of-bounds memory when parsing unclosed HTML comments. A remote attacker could provide a specially crafted XML file that, when processed by an application linked against libxml2, could cause the application to disclose heap memory contents.(CVE-2015-8710)

A denial of service flaw was found in the way the libxml2 library parsed certain XML files. An attacker could provide a specially crafted XML file that, when parsed by an application using libxml2, could cause that application to use an excessive amount of memory.

The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941 .

libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities.

A heap-based buffer overflow vulnerability was found in xmlDictComputeFastQKey in dict.c.

A heap-based buffer overflow read in xmlParseMisc was found.

A heap-based buffer overflow was found in xmlGROW allowing the attacker to read the memory out of bounds.

A buffer overread in xmlNextChar was found, causing segmentation fault when compiled with ASAN.

Heap-based buffer overflow was found in xmlParseXmlDecl. When conversion failure happens, parser continues to extract more errors which may lead to unexpected behaviour.

Stack-based buffer overread vulnerability with HTML parser in push mode in xmlSAX2TextNode causing segmentation fault when compiled with ASAN.

A vulnerability in libxml2 was found causing DoS by exhausting CPU when parsing specially crafted XML document.

An out-of-bounds heap read in xmlParseXMLDecl happens when a file containing unfinished xml declaration.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1391 advisory.

    This advisory aggregates security fixes for the libxml2 SRPM in CIQ LTS 9.6. It addresses 39 CVEs:
    CVE-2010-4494, CVE-2009-2414, CVE-2015-7498, CVE-2022-40304, CVE-2024-25062, and 34 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

reports :

CVE-2015-5312 Another entity expansion issue (David Drysdale).

CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey (David Drysdale).

CVE-2015-7498 Avoid processing entities after encoding conversion failures (Daniel Veillard).

CVE-2015-7499 (1) Add xmlHaltParser() to stop the parser (Daniel Veillard).

CVE-2015-7499 (2) Detect incoherency on GROW (Daniel Veillard).

CVE-2015-7500 Fix memory access error due to incorrect entities boundaries (Daniel Veillard).

CVE-2015-7941 (1) Stop parsing on entities boundaries errors (Daniel Veillard).

CVE-2015-7941 (2) Cleanup conditional section error handling (Daniel Veillard).

CVE-2015-7942 Another variation of overflow in Conditional sections (Daniel Veillard).

CVE-2015-7942 (2) Fix an error in previous Conditional section patch (Daniel Veillard).

CVE-2015-8035 Fix XZ compression support loop (Daniel Veillard).

CVE-2015-8242 Buffer overead with HTML parser in push mode (Hugh Davenport)

The remote host is missing AIX PTF U870330, which is related to the security of the package bos.rte.control.

Libxml2 is vulnerable to a denial of service, caused by a heap-based buffer overflow in the xmlParseEntityDecl or xmlParseConditionalSections function. By using a specially crafted XML data, a remote attacker could exploit this vulnerability to trigger an out-of-bounds read and cause the system to crash. Libxml2 is vulnerable to a denial of service, caused by a heap-based buffer overflow in the xmlParseConditionalSections function. By using a specially crafted XML data, a remote attacker could exploit this vulnerability to trigger an out-of-bounds read and cause the system to crash. libxml2 is vulnerable to a buffer overflow, caused by improper bounds checking by the XML parser in xmlNextChar. By using a malformed XML file, a local attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-2550 advisory.

    - CVE-2015-7941 Stop parsing on entities boundaries errors
    - CVE-2015-7941 Cleanup conditional section error handling
    - CVE-2015-8317 Fail parsing early on if encoding conversion failed
    - CVE-2015-7942 Another variation of overflow in Conditional sections
    - CVE-2015-7942 Fix an error in previous Conditional section patch
    - CVE-2015-7498 Avoid processing entities after encoding conversion failures
    - CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey
    - CVE-2015-5312 Another entity expansion issue
    - CVE-2015-7499 Add xmlHaltParser() to stop the parser
    - CVE-2015-7499 Detect incoherency on GROW
    - CVE-2015-7500 Fix memory access error due to incorrect entities boundaries
    - CVE-2015-8242 Buffer overead with HTML parser in push mode
    - CVE-2015-1819 Enforce the reader to run in constant memory
    - Fix missing entities after CVE-2014-3660 fix
    - CVE-2014-0191 Do not fetch external parameter entities (rhbz#1195650)
    - Fix regressions introduced by CVE-2014-0191 patch

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- security update: This update fixes the following     security issues :

  - CVE-2015-1819 Enforce the reader to run in constant     memory [bnc#928193]

  - CVE-2015-7941 Fix out of bound read with crafted xml     input by stopping parsing on entities boundaries errors     [bnc#951734]

  - CVE-2015-7942 Fix another variation of overflow in     Conditional sections [bnc#951735]

  - CVE-2015-8241 Avoid extra processing of MarkupDecl when     EOF [bnc#956018]

  - CVE-2015-8242 Buffer overead with HTML parser in push     mode [bnc#956021]

  - CVE-2015-8317 Return if the encoding declaration is     broken or encoding conversion failed [bnc#956260]

  - CVE-2015-5312 Fix another entity expansion issue     [bnc#957105]

  - CVE-2015-7497 Avoid an heap buffer overflow in     xmlDictComputeFastQKey [bnc#957106]

  - CVE-2015-7498 Processes entities after encoding     conversion failures [bnc#957107]

  - CVE-2015-7499 Add xmlHaltParser() to stop the parser /     Detect incoherency on GROW [bnc#957109]

  - CVE-2015-8317 Multiple out-of-bound read could lead to     denial of service [bnc#956260]

  - CVE-2015-8035 DoS when parsing specially crafted XML     document if XZ support is enabled [bnc#954429]

  - CVE-2015-7500 Fix memory access error due to incorrect     entities boundaries [bnc#957110] This update was     imported from the SUSE:SLE-12:Update update project.

Update to 2.9.3 which fixes various CVE's

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0100 advisory.

    This advisory aggregates security fixes for the libxml2 SRPM in CIQ LTS 8.6. It addresses 30 CVEs:
    CVE-2015-7499, CVE-2015-7942, CVE-2018-14404, CVE-2008-4225, CVE-2015-7497, and 25 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The mobile device is running a version of iOS prior to version 9.3. It is, therefore, affected by multiple vulnerabilities in the following components :

  - AppleUSBNetworking
  - FontParser
  - HTTPProtocol
  - IOHIDFamily
  - Kernel
  - LaunchServices
  - libxml2
  - Messages
  - Profiles
  - Security
  - TrueTypeScaler
  - WebKit
  - Wi-Fi

ID	名稱	產品	系列	已發布	已更新	嚴重性
125603	Amazon Linux 2 : libxml2 (ALAS-2019-1220)	Nessus	Amazon Linux Local Security Checks	2019/5/31	2024/5/17	critical
87354	Amazon Linux AMI : libxml2 (ALAS-2015-628)	Nessus	Amazon Linux Local Security Checks	2015/12/15	2018/4/18	high
354769	Rocky Linux 9.6 [CIQ] Security Update: libxml2 / libxml2-devel / python3-libxml2 Multiple Vulnerabilities (ciqsa-2026_1391)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	2023/6/30	2023/7/6	critical
87000	FreeBSD : libxml2 -- multiple vulnerabilities (e5423caf-8fb8-11e5-918c-bcaec565249c)	Nessus	FreeBSD Local Security Checks	2015/11/23	2021/1/6	high
91237	AIX 7.2 : bos.rte.control (U870330)	Nessus	AIX Local Security Checks	2016/5/19	2021/1/4	medium
87231	Oracle Linux 7 : libxml2 (ELSA-2015-2550)	Nessus	Oracle Linux Local Security Checks	2015/12/8	2024/11/1	critical
88122	openSUSE Security Update : libxml2 (openSUSE-2016-32)	Nessus	SuSE Local Security Checks	2016/1/25	2021/1/19	high
89591	Fedora 22 : mingw-libxml2-2.9.3-1.fc22 (2016-a9ee80b01d)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	medium
358180	Rocky Linux 8.6 [CIQ] Security Update: libxml2 / libxml2-debuginfo / libxml2-debugsource / libxml2-devel / etc Multiple Vulnerabilities (ciqsa-2026_0100)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/11	high
90118	Apple iOS < 9.3 Multiple Vulnerabilities	Nessus	Mobile Devices	2016/3/23	2026/11/9	critical

偵測

搜尋 Plugin

critical

high

critical

critical

high

medium

critical

high

medium

high

critical