The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:22785 advisory.

    Expat is a C library for parsing XML documents.

    Security Fix(es):

    * expat: internal entity expansion (CVE-2013-0340)

    * expat: Large number of prefixed XML attributes on a single tag can crash libexpat (CVE-2021-45960)

    * expat: Integer overflow in doProlog in xmlparse.c (CVE-2021-46143)

    * expat: Integer overflow in addBinding in xmlparse.c (CVE-2022-22822)

    * expat: Integer overflow in build_model in xmlparse.c (CVE-2022-22823)

    * expat: Integer overflow in defineAttribute in xmlparse.c (CVE-2022-22824)

    * expat: Integer overflow in lookup in xmlparse.c (CVE-2022-22825)

    * expat: Integer overflow in nextScaffoldPart in xmlparse.c (CVE-2022-22826)

    * expat: Integer overflow in storeAtts in xmlparse.c (CVE-2022-22827)

    * expat: integer overflow in the doProlog function (CVE-2022-23990)

    * expat: Stack exhaustion in doctype parsing (CVE-2022-25313)

    * expat: Integer overflow in copyString() (CVE-2022-25314)

    * expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate     (CVE-2022-43680)

    * expat: parsing large tokens can trigger a denial of service (CVE-2023-52425)

    * libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat (CVE-2024-8176)

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:22035 advisory.

    Expat is a C library for parsing XML documents.

    Security Fix(es):

    * expat: internal entity expansion (CVE-2013-0340)

    * expat: parsing large tokens can trigger a denial of service (CVE-2023-52425)

    * libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat (CVE-2024-8176)

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the expat package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses     the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service     (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML     document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already     provides the ability to disable external entity expansion, the responsibility for resolving this issue     lies with application developers; according to this argument, this entry should be REJECTed, and each     affected application would need its own CVE. (CVE-2013-0340)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses     the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service     (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML     document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already     provides the ability to disable external entity expansion, the responsibility for resolving this issue     lies with application developers; according to this argument, this entry should be REJECTed, and each     affected application would need its own CVE. (CVE-2013-0340)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Kurt Seifried reports :

So here are the CVE's for the two big ones, libxml2 and expat. Both are affected by the expansion of internal entities (which can be used to consume resources) and external entities (which can cause a denial of service against other services, be used to port scan, etc.).

A billion laughs attack is a type of denial-of-service attack which is aimed at parsers of XML documents.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:22607 advisory.

    Expat is a C library for parsing XML documents.

    Security Fix(es):

    * expat: internal entity expansion (CVE-2013-0340)

    * expat: integer overflow in the doProlog function (CVE-2022-23990)

    * libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat (CVE-2024-8176)

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Netezza Analytics installed on the remote Linux host is 1.2.1 - 3.2.1. It is, therefore, affected by multiple vulnerabilities in the Open Source James Clark Expat component.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
277504	RHEL 8 : expat (RHSA-2025:22785)	Nessus	Red Hat Local Security Checks	2025/12/4	2025/12/4	critical
276721	RHEL 9 : expat (RHSA-2025:22035)	Nessus	Red Hat Local Security Checks	2025/11/25	2025/11/25	high
153698	EulerOS 2.0 SP9 : expat (EulerOS-SA-2021-2524)	Nessus	Huawei Local Security Checks	2021/9/27	2023/11/29	critical
153711	EulerOS 2.0 SP9 : expat (EulerOS-SA-2021-2548)	Nessus	Huawei Local Security Checks	2021/9/27	2023/11/29	critical
155509	EulerOS Virtualization 2.9.1 : expat (EulerOS-SA-2021-2756)	Nessus	Huawei Local Security Checks	2021/11/17	2023/11/23	critical
155536	EulerOS Virtualization 2.9.0 : expat (EulerOS-SA-2021-2784)	Nessus	Huawei Local Security Checks	2021/11/17	2023/11/23	critical
149883	FreeBSD : texproc/expat2 -- billion laugh attack (5fa90ee6-bc9e-11eb-a287-e0d55e2a8bf9)	Nessus	FreeBSD Local Security Checks	2021/5/25	2023/12/29	critical
277137	RHEL 8 : expat (RHSA-2025:22607)	Nessus	Red Hat Local Security Checks	2025/12/3	2025/12/3	high
106714	IBM Netezza Analytics Open Source James Clark Expat Multiple Vulnerabilities (swg22012645)	Nessus	General	2018/2/9	2025/10/30	medium

检测

插件搜索

critical

high

critical

critical

critical

critical

critical

high

medium