The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-1206 advisory.

    - Fix a couple of crash CVE-2009-2414 and CVE-2009-2416

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2009-2414 libxml, libxml2, mingw32-libxml2: Stack overflow by parsing root XML element DTD definition

CVE-2009-2416 libxml, libxml2, mingw32-libxml2: Pointer use-after-free flaws by parsing Notation and Enumeration attribute types

A stack overflow flaw was found in the way libxml processes the root XML document element definition in a DTD. A remote attacker could provide a specially crafted XML file, which once opened by a local, unsuspecting user, would lead to denial of service (application crash). (CVE-2009-2414)

Multiple use-after-free flaws were found in the way libxml parses the Notation and Enumeration attribute types. A remote attacker could provid a specially crafted XML file, which once opened by a local, unsuspecting user, would lead to denial of service (application crash). (CVE-2009-2416)

The desktop must be restarted (log out, then log back in) for this update to take effect.

This update includes patches from RHEL-3 addressing a number of security vulnerabilities: - CVE-2004-0110 (arbitrary code execution via a long URL) - CVE-2004-0989 (arbitrary code execution via a long URL) - CVE-2009-2414 (stack consumption DoS vulnerabilities) - CVE-2009-2416 (use-after-free DoS vulnerabilities)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of libxml does not use pointers after they were freed anymore. (CVE-2009-2416) Additionally a stack-based buffer overflow was fixed while parsing the root XML document. (CVE-2009-2414)

This update of libxml2 does not use pointers after they were freed anymore. (CVE-2009-2416) Additionally a stack-based buffer overflow was fixed while parsing the root XML document. (CVE-2009-2414)

Multiple use-after-free vulnerabilities in libxml 1.8.17 that allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file.

Updated libxml and libxml2 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

libxml is a library for parsing and manipulating XML files. A Document Type Definition (DTD) defines the legal syntax (and also which elements can be used) for certain types of files, such as XML files.

A stack overflow flaw was found in the way libxml processes the root XML document element definition in a DTD. A remote attacker could provide a specially crafted XML file, which once opened by a local, unsuspecting user, would lead to denial of service (application crash). (CVE-2009-2414)

Multiple use-after-free flaws were found in the way libxml parses the Notation and Enumeration attribute types. A remote attacker could provide a specially crafted XML file, which once opened by a local, unsuspecting user, would lead to denial of service (application crash). (CVE-2009-2416)

Users should upgrade to these updated packages, which contain backported patches to resolve these issues. For Red Hat Enterprise Linux 3, they contain backported patches for the libxml and libxml2 packages. For Red Hat Enterprise Linux 4 and 5, they contain backported patches for the libxml2 packages. The desktop must be restarted (log out, then log back in) for this update to take effect.

It was discovered that libxml2 did not correctly handle root XML document element DTD definitions. If a user were tricked into processing a specially crafted XML document, a remote attacker could cause the application linked against libxml2 to crash, leading to a denial of service. (CVE-2009-2414)

It was discovered that libxml2 did not correctly parse Notation and Enumeration attribute types. If a user were tricked into processing a specially crafted XML document, a remote attacker could cause the application linked against libxml2 to crash, leading to a denial of service. (CVE-2009-2416)

USN-644-1 fixed a vulnerability in libxml2. This advisory provides the corresponding update for Ubuntu 9.04.

It was discovered that libxml2 did not correctly handle long entity names. If a user were tricked into processing a specially crafted XML document, a remote attacker could execute arbitrary code with user privileges or cause the application linked against libxml2 to crash, leading to a denial of service. (CVE-2008-3529).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201009-07 (libxml2: Denial of Service)

    The following vulnerabilities were reported after a test with the     Codenomicon XML fuzzing framework:
    Two use-after-free vulnerabilities are possible when parsing a XML file     with Notation or Enumeration attribute types (CVE-2009-2416).
    A stack consumption vulnerability can be triggered via a large depth of     element declarations in a DTD, related to a function recursion     (CVE-2009-2414).
  Impact :

    A remote attacker could entice a user or automated system to open a     specially crafted XML document with an application using libxml2     resulting in a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2009-377:01 advisory.

    This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML     files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse     time or later once the document has been modified. The output can be a simple SAX stream or and in-memory     DOM like representations. In this case one can use the built-in XPath and XPointer implementation to     select subnodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP     modules and combined to an URI library.
    Fixed bugs:
    CVE-2009-2414     Stack consumption vulnerability in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17,     allows context-dependent attackers to cause a denial of service (application crash) via a large depth of     element declarations in a DTD, related to a function recursion, as demonstrated by the Codenomicon XML     fuzzing framework.
    CVE-2009-2416     Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml     1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1)     Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing     framework.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
67909	Oracle Linux 5 : libxml / and / libxml2 (ELSA-2009-1206)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	medium
60637	Scientific Linux Security Update : libxml and libxml2 on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
40603	Fedora 11 : libxml-1.8.17-24.fc11 (2009-8582)	Nessus	Fedora Local Security Checks	2009/8/18	2021/1/11	critical
40604	Fedora 10 : libxml-1.8.17-24.fc10 (2009-8594)	Nessus	Fedora Local Security Checks	2009/8/18	2021/1/11	critical
42020	openSUSE 10 Security Update : libxml (libxml-6477)	Nessus	SuSE Local Security Checks	2009/10/6	2021/1/14	medium
42021	openSUSE 10 Security Update : libxml2 (libxml2-6405)	Nessus	SuSE Local Security Checks	2009/10/6	2021/1/14	medium
56773	FreeBSD : libxml -- Multiple use-after-free vulnerabilities (ce4b3af8-0b7c-11e1-846b-00235409fd3e)	Nessus	FreeBSD Local Security Checks	2011/11/11	2021/1/6	medium
40533	CentOS 3 / 5 : libxml / libxml2 (CESA-2009:1206)	Nessus	CentOS Local Security Checks	2009/8/11	2021/1/4	medium
40544	RHEL 3 / 4 / 5 : libxml and libxml2 (RHSA-2009:1206)	Nessus	Red Hat Local Security Checks	2009/8/11	2021/1/14	medium
40576	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : libxml2 vulnerabilities (USN-815-1)	Nessus	Ubuntu Local Security Checks	2009/8/12	2021/1/19	critical
41002	openSUSE Security Update : libxml (libxml-1278)	Nessus	SuSE Local Security Checks	2009/9/17	2021/1/14	medium
41004	openSUSE Security Update : libxml (libxml-1278)	Nessus	SuSE Local Security Checks	2009/9/17	2021/1/14	medium
49636	GLSA-201009-07 : libxml2: Denial of Service	Nessus	Gentoo Local Security Checks	2010/9/22	2021/1/6	medium
284012	MiracleLinux 3 : libxml2-2.6.26-2.1.2.8.1AXS3 (AXSA:2009-377:01)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	medium

检测

插件搜索

medium

medium

critical

critical

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium