This update of libxml does not use pointers after they were freed anymore. (CVE-2009-2416) Additionally a stack-based buffer overflow was fixed while parsing the root XML document. (CVE-2009-2414)

Updated libxml and libxml2 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

libxml is a library for parsing and manipulating XML files. A Document Type Definition (DTD) defines the legal syntax (and also which elements can be used) for certain types of files, such as XML files.

A stack overflow flaw was found in the way libxml processes the root XML document element definition in a DTD. A remote attacker could provide a specially crafted XML file, which once opened by a local, unsuspecting user, would lead to denial of service (application crash). (CVE-2009-2414)

Multiple use-after-free flaws were found in the way libxml parses the Notation and Enumeration attribute types. A remote attacker could provide a specially crafted XML file, which once opened by a local, unsuspecting user, would lead to denial of service (application crash). (CVE-2009-2416)

Users should upgrade to these updated packages, which contain backported patches to resolve these issues. For Red Hat Enterprise Linux 3, they contain backported patches for the libxml and libxml2 packages. For Red Hat Enterprise Linux 4 and 5, they contain backported patches for the libxml2 packages. The desktop must be restarted (log out, then log back in) for this update to take effect.

It was discovered that libxml2 did not correctly handle root XML document element DTD definitions. If a user were tricked into processing a specially crafted XML document, a remote attacker could cause the application linked against libxml2 to crash, leading to a denial of service. (CVE-2009-2414)

It was discovered that libxml2 did not correctly parse Notation and Enumeration attribute types. If a user were tricked into processing a specially crafted XML document, a remote attacker could cause the application linked against libxml2 to crash, leading to a denial of service. (CVE-2009-2416)

USN-644-1 fixed a vulnerability in libxml2. This advisory provides the corresponding update for Ubuntu 9.04.

It was discovered that libxml2 did not correctly handle long entity names. If a user were tricked into processing a specially crafted XML document, a remote attacker could execute arbitrary code with user privileges or cause the application linked against libxml2 to crash, leading to a denial of service. (CVE-2008-3529).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2009-006 applied.

This security update contains fixes for the following products :

  - AFP Client
  - Adaptive Firewall
  - Apache
  - Apache Portable Runtime
  - ATS
  - Certificate Assistant
  - CoreGraphics
  - CUPS
  - Dictionary
  - DirectoryService
  - Disk Images
  - Event Monitor
  - fetchmail
  - FTP Server
  - Help Viewer
  - International Components for Unicode
  - IOKit
  - IPSec
  - libsecurity
  - libxml
  - OpenLDAP
  - OpenSSH
  - PHP
  - QuickDraw Manager
  - QuickLook
  - FreeRADIUS
  - Screen Sharing
  - Spotlight
  - Subversion

The remote host is running a version of Mac OS X 10.6 that is older than version 10.6.2.  Mac OS X 10.6.2 contains security fixes for the following products : 

  - Adaptive Firewall

  - Apache

  - Apache Protable Runtime

  - Certificate Assistant

  - CoreMedia

  - CUPS

  - DoveCot

  - fetchmail

  - file

  - FTP Server

  - Help Viewer

  - ImageIO

  - IOKit

  - IPSec

  - Kernel

  - Launch Services

  - libsecurity

  - libxml

 Login Window

  - OpenLDAP

  - QuickDraw Manager

QuickTime

  - Screen Sharing

  - Subversion

The version of Safari installed on the remote host is earlier than 4.0.4.  Such versions are potentially affected by multiple issues : 

  - An integer overflow exists in the handling of images with an embedded color profile, which may lead to a heap buffer overflow. (CVE-2009-2804)

  - Multiple use-after-free issues exist in libxml2, the most serious of which may lead to an unexpected application termination. (CVE-2009-2414, CVE-2009-2416)

  - An issue exists in Safari's handling of navigations initiated via the "Open Image in New Tab", "Open Image in New Window", or "Open Link in New Tab" shortcut menu options. Using these options within a maliciously crafted website could load a local HTML file, leading to the disclosure of sensitive information. (CVE-2009-2842)

  - An issue exists in WebKit's implementation of Cross-Origin Resource Sharing which could lead to cross-site request forger attacks. (CVE-2009-2816)

  - Multiple vulnerabilities exist in WebKit's handling of FTP directory listings. Accessing a maliciously crafted FTP server may lead to information disclosure, unexpected application termination, or execution of arbitrary code. (CVE-2009-3384)

  - When WebKit encounters an HTML 5 Media Element pointing to an external resource, it does not issue a resource load callback to determine if the resource should be loaded. This may result in undesired requests to remote servers. (CVE-2009-2841)

The remote mobile host is a using a version of Apple iOS earlier than 4.0. Such versions are potentially affected by multiple vulnerabilities. Apple iOS 4.0 contains security fixes for the following components :

  - Application Sandbox

  - CFNetwork

  - ImageIO

  - LibSystem

  - libxml

  - Passcode Lock

  - Safari

  - Settings

  - WebKit

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
51756	SuSE 10 Security Update : libxml (ZYPP Patch Number 6482)	Nessus	SuSE Local Security Checks	2011/1/27	2021/1/14	medium
40533	CentOS 3 / 5 : libxml / libxml2 (CESA-2009:1206)	Nessus	CentOS Local Security Checks	2009/8/11	2021/1/4	medium
40544	RHEL 3 / 4 / 5 : libxml and libxml2 (RHSA-2009:1206)	Nessus	Red Hat Local Security Checks	2009/8/11	2021/1/14	medium
40576	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : libxml2 vulnerabilities (USN-815-1)	Nessus	Ubuntu Local Security Checks	2009/8/12	2021/1/19	critical
42433	Mac OS X Multiple Vulnerabilities (Security Update 2009-006)	Nessus	MacOS X Local Security Checks	2009/11/9	2024/5/28	critical
5227	Mac OS X 10.6 < 10.6.2 Multiple Vulnerabilities	Nessus Network Monitor	Generic	2009/11/10	2019/3/6	critical
5232	Safari < 4.0.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2009/11/11	2019/3/6	medium
5578	Apple iOS < 4.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	2010/6/22	2019/3/6	critical

检测

插件搜索

medium

medium

medium

critical

critical

critical

medium

critical