Multiple vulnerabilities has been found and corrected in libxml :

Stack consumption vulnerability in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allows context-dependent attackers to cause a denial of service (application crash) via a large depth of element declarations in a DTD, related to a function recursion, as demonstrated by the Codenomicon XML fuzzing framework (CVE-2009-2414).

Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing framework (CVE-2009-2416).

This update provides a solution to these vulnerabilities.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

two patches for parsing problems raised by Ficora

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of libxml does not use pointers after they were freed anymore. (CVE-2009-2416) Additionally a stack-based buffer overflow was fixed while parsing the root XML document. (CVE-2009-2414)

This update of libxml2 does not use pointers after they were freed anymore. (CVE-2009-2416)

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in the following components :

  - Apache Geronimo
  - Apache Tomcat
  - Apache Xerces2
  - cURL/libcURL
  - ISC BIND
  - Libxml2
  - Linux kernel
  - Linux kernel 64-bit
  - Linux kernel Common Internet File System
  - Linux kernel eCryptfs
  - NTP
  - Python
  - Java Runtime Environment (JRE)
  - Java SE Development Kit (JDK)
  - Java SE Abstract Window Toolkit (AWT)
  - Java SE Plugin
  - Java SE Provider
  - Java SE Swing
  - Java SE Web Start

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2009-377:01 advisory.

    This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML     files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse     time or later once the document has been modified. The output can be a simple SAX stream or and in-memory     DOM like representations. In this case one can use the built-in XPath and XPointer implementation to     select subnodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP     modules and combined to an URI library.
    Fixed bugs:
    CVE-2009-2414     Stack consumption vulnerability in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17,     allows context-dependent attackers to cause a denial of service (application crash) via a large depth of     element declarations in a DTD, related to a function recursion, as demonstrated by the Codenomicon XML     fuzzing framework.
    CVE-2009-2416     Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml     1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1)     Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing     framework.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated libxml and libxml2 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

libxml is a library for parsing and manipulating XML files. A Document Type Definition (DTD) defines the legal syntax (and also which elements can be used) for certain types of files, such as XML files.

A stack overflow flaw was found in the way libxml processes the root XML document element definition in a DTD. A remote attacker could provide a specially crafted XML file, which once opened by a local, unsuspecting user, would lead to denial of service (application crash). (CVE-2009-2414)

Multiple use-after-free flaws were found in the way libxml parses the Notation and Enumeration attribute types. A remote attacker could provide a specially crafted XML file, which once opened by a local, unsuspecting user, would lead to denial of service (application crash). (CVE-2009-2416)

Users should upgrade to these updated packages, which contain backported patches to resolve these issues. For Red Hat Enterprise Linux 3, they contain backported patches for the libxml and libxml2 packages. For Red Hat Enterprise Linux 4 and 5, they contain backported patches for the libxml2 packages. The desktop must be restarted (log out, then log back in) for this update to take effect.

It was discovered that libxml2 did not correctly handle root XML document element DTD definitions. If a user were tricked into processing a specially crafted XML document, a remote attacker could cause the application linked against libxml2 to crash, leading to a denial of service. (CVE-2009-2414)

It was discovered that libxml2 did not correctly parse Notation and Enumeration attribute types. If a user were tricked into processing a specially crafted XML document, a remote attacker could cause the application linked against libxml2 to crash, leading to a denial of service. (CVE-2009-2416)

USN-644-1 fixed a vulnerability in libxml2. This advisory provides the corresponding update for Ubuntu 9.04.

It was discovered that libxml2 did not correctly handle long entity names. If a user were tricked into processing a specially crafted XML document, a remote attacker could execute arbitrary code with user privileges or cause the application linked against libxml2 to crash, leading to a denial of service. (CVE-2008-3529).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201009-07 (libxml2: Denial of Service)

    The following vulnerabilities were reported after a test with the     Codenomicon XML fuzzing framework:
    Two use-after-free vulnerabilities are possible when parsing a XML file     with Notation or Enumeration attribute types (CVE-2009-2416).
    A stack consumption vulnerability can be triggered via a large depth of     element declarations in a DTD, related to a function recursion     (CVE-2009-2414).
  Impact :

    A remote attacker could entice a user or automated system to open a     specially crafted XML document with an application using libxml2     resulting in a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Multiple use-after-free vulnerabilities in libxml 1.8.17 that allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
40584	Mandriva Linux Security Advisory : libxml (MDVSA-2009:200-1)	Nessus	Mandriva Local Security Checks	2009/8/13	2021/1/6	medium
40602	Fedora 11 : mingw32-libxml2-2.7.3-2.fc11 (2009-8580)	Nessus	Fedora Local Security Checks	2009/8/18	2021/1/11	medium
41325	SuSE9 Security Update : libxml.rpm (YOU Patch Number 12504)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	medium
41436	SuSE 11 Security Update : libxml2 (SAT Patch Number 1177)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	medium
51756	SuSE 10 Security Update : libxml (ZYPP Patch Number 6482)	Nessus	SuSE Local Security Checks	2011/1/27	2021/1/14	medium
89117	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2009-0016) (remote check)	Nessus	Misc.	2016/3/3	2021/1/6	critical
284012	MiracleLinux 3 : libxml2-2.6.26-2.1.2.8.1AXS3 (AXSA:2009-377:01)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	medium
40533	CentOS 3 / 5 : libxml / libxml2 (CESA-2009:1206)	Nessus	CentOS Local Security Checks	2009/8/11	2021/1/4	medium
40544	RHEL 3 / 4 / 5 : libxml and libxml2 (RHSA-2009:1206)	Nessus	Red Hat Local Security Checks	2009/8/11	2021/1/14	medium
40576	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : libxml2 vulnerabilities (USN-815-1)	Nessus	Ubuntu Local Security Checks	2009/8/12	2021/1/19	critical
41002	openSUSE Security Update : libxml (libxml-1278)	Nessus	SuSE Local Security Checks	2009/9/17	2021/1/14	medium
41004	openSUSE Security Update : libxml (libxml-1278)	Nessus	SuSE Local Security Checks	2009/9/17	2021/1/14	medium
49636	GLSA-201009-07 : libxml2: Denial of Service	Nessus	Gentoo Local Security Checks	2010/9/22	2021/1/6	medium
56773	FreeBSD : libxml -- Multiple use-after-free vulnerabilities (ce4b3af8-0b7c-11e1-846b-00235409fd3e)	Nessus	FreeBSD Local Security Checks	2011/11/11	2021/1/6	medium

检测

插件搜索

medium

medium

medium

medium

medium

critical

medium

medium

medium

critical

medium

medium

medium

medium