Several vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause a denial-of-service against the application, information leaks, or potentially, the execution of arbitrary code with the privileges of the user running the application.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3424-1 advisory.

    It was discovered that a type confusion error existed in libxml2. An attacker could use this to specially     construct XML data that could cause a denial of service or possibly execute arbitrary code.
    (CVE-2017-0663)

    It was discovered that libxml2 did not properly validate parsed entity references. An attacker could use     this to specially construct XML data that could expose sensitive information. (CVE-2017-7375)

    It was discovered that a buffer overflow existed in libxml2 when handling HTTP redirects. An attacker     could use this to specially construct XML data that could cause a denial of service or possibly execute     arbitrary code. (CVE-2017-7376)

    Marcel Bhme and Van-Thuan Pham discovered a buffer overflow in libxml2 when handling elements. An     attacker could use this to specially construct XML data that could cause a denial of service or possibly     execute arbitrary code. (CVE-2017-9047)

    Marcel Bhme and Van-Thuan Pham discovered a buffer overread in libxml2 when handling elements. An     attacker could use this to specially construct XML data that could cause a denial of service.
    (CVE-2017-9048)

    Marcel Bhme and Van-Thuan Pham discovered multiple buffer overreads in libxml2 when handling parameter-     entity references. An attacker could use these to specially construct XML data that could cause a denial     of service. (CVE-2017-9049, CVE-2017-9050)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 7.9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0710 advisory.

    This advisory aggregates security fixes for the libxml2 SRPM in CIQ CentOS Bridge 7.9. It addresses 15     CVEs: CVE-2024-25062, CVE-2023-39615, CVE-2017-9048, CVE-2017-0663, CVE-2017-9050, and 10 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libxml2 fixes the following issues :

  - CVE-2017-9047, CVE-2017-9048: The function     xmlSnprintfElementContent in valid.c was vulnerable to a     stack-based buffer overflow (bsc#1039063, bsc#1039064)

  - CVE-2017-9049: The function xmlDictComputeFastKey in     dict.c was vulnerable to a heap-based buffer over-read.
    (bsc#1039066)

  - CVE-2017-9050: The function xmlDictAddString was     vulnerable to a heap-based buffer over-read     (bsc#1039661)

  - CVE-2016-1839: heap-based buffer overflow     (xmlDictAddString func) (bnc#1039069)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An integer overflow in xmlmemory.c in libxml2 before     2.9.5, as used in Google Chrome prior to 62.0.3202.62     and other products, allowed a remote attacker to     potentially exploit heap corruption via a crafted XML     file.(CVE-2017-5130)

  - libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a     heap-based buffer over-read in the     xmlDictComputeFastKey function in dict.c. This     vulnerability causes programs that use libxml2, such as     PHP, to crash. (CVE-2017-9049)

  - A flaw in libxml2 allows remote XML entity inclusion     with default parser flags (i.e., when the caller did     not request entity substitution, DTD validation,     external DTD subset loading, or default DTD     attributes). Depending on the context, this may expose     a higher-risk attack surface in libxml2 not usually     reachable with default parser flags, and expose content     from local files, HTTP, or FTP servers (which might be     otherwise unreachable).(CVE-2017-7375)

  - Buffer overflow in libxml2 allows remote attackers to     execute arbitrary code by leveraging an incorrect limit     for port values when handling redirects.(CVE-2017-7376)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running Mac OS X 10.11.6 or Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities affecting the following components :

  - 802.1X
  - apache
  - AppleScript
  - ATS
  - Audio
  - CFString
  - CoreText
  - curl
  - Dictionary Widget
  - file
  - Fonts
  - fsck_msdos
  - HFS
  - Heimdal
  - HelpViewer
  - ImageIO
  - Kernel
  - libarchive
  - Open Scripting Architecture
  - PCRE
  - Postfix
  - Quick Look
  - QuickTime
  - Remote Management
  - Sandbox
  - StreamingZip
  - tcpdump
  - Wi-Fi

According to the versions of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a     heap-based buffer over-read in the xmlDictAddString     function in dict.c. This vulnerability causes programs     that use libxml2, such as PHP, to crash. This     vulnerability exists because of an incomplete fix for     CVE-2016-1839.(CVE-2017-9050)

  - libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a     heap-based buffer over-read in the     xmlDictComputeFastKey function in dict.c. This     vulnerability causes programs that use libxml2, such as     PHP, to crash. This vulnerability exists because of an     incomplete fix for libxml2 Bug 759398.(CVE-2017-9049)

  - libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a     stack-based buffer overflow. The function     xmlSnprintfElementContent in valid.c is supposed to     recursively dump the element content definition into a     char buffer 'buf' of size 'size'. At the end of the     routine, the function may strcat two more characters     without checking whether the current strlen(buf) + 2 <     size. This vulnerability causes programs that use     libxml2, such as PHP, to crash.(CVE-2017-9048)

  - The htmlParseTryOrFinish function in HTMLparser.c in     libxml2 2.9.4 allows attackers to cause a denial of     service (buffer over-read) or information     disclosure.(CVE-2017-8872)

  - The xz_decomp function in xzlib.c in libxml2 2.9.8, if
    --with-lzma is used, allows remote attackers to cause a     denial of service (infinite loop) via a crafted XML     file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated     by xmllint, a different vulnerability than     CVE-2015-8035.(CVE-2018-9251)

  - libxml2 2.9.8, if --with-lzma is used, allows remote     attackers to cause a denial of service (infinite loop)     via a crafted XML file that triggers     LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a     different vulnerability than CVE-2015-8035 and     CVE-2018-9251.(CVE-2018-14567)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

This update for libxml2 fixes the following security issues :

  - CVE-2017-9050: A heap-based buffer over-read in     xmlDictAddString (bsc#1039069, bsc#1039661)

  - CVE-2017-9049: A heap-based buffer overflow in     xmlDictComputeFastKey (bsc#1039066)

  - CVE-2017-9048: A stack overflow vulnerability in     xmlSnprintfElementContent (bsc#1039063)

  - CVE-2017-9047: A stack overflow vulnerability in     xmlSnprintfElementContent (bsc#1039064)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

The remote host is affected by the vulnerability described in GLSA-201711-01 (libxml2: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libxml2. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by enticing a user to process a specially crafted XML       document, could remotely execute arbitrary code, conduct XML External       Entity (XXE) attacks, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
102685	Debian DSA-3952-1 : libxml2 - security update	Nessus	Debian Local Security Checks	2017/8/23	2025/11/26	critical
103327	Ubuntu 14.04 LTS / 16.04 LTS : libxml2 vulnerabilities (USN-3424-1)	Nessus	Ubuntu Local Security Checks	2017/9/19	2024/8/27	critical
356436	CentOS Linux 7.9 [CIQ] Security Update: libxml2 / libxml2-debuginfo / libxml2-devel / libxml2-python / etc Multiple Vulnerabilities (ciqsa-2026_0710)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/12	critical
100544	SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2017:1454-1)	Nessus	SuSE Local Security Checks	2017/5/31	2025/12/17	high
108474	EulerOS 2.0 SP1 : libxml2 (EulerOS-SA-2018-1070)	Nessus	Huawei Local Security Checks	2018/3/20	2025/1/28	critical
104379	macOS and Mac OS X Multiple Vulnerabilities (Security Update 2017-001 and 2017-004)	Nessus	MacOS X Local Security Checks	2017/11/3	2025/11/14	critical
134734	EulerOS Virtualization 3.0.2.2 : libxml2 (EulerOS-SA-2020-1268)	Nessus	Huawei Local Security Checks	2020/3/20	2024/3/21	critical
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	2023/6/30	2023/7/6	critical
100884	openSUSE Security Update : libxml2 (openSUSE-2017-711)	Nessus	SuSE Local Security Checks	2017/6/20	2025/12/16	high
104492	GLSA-201711-01 : libxml2: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/11/10	2025/11/14	critical

检测

插件搜索

critical

critical

critical

high

critical

critical

critical

critical

high

critical