远程 Debian 11 主机上安装的多个程序包受到 dla-4251 公告中提及的多个漏洞影响。

    ------------------------------------------------------------------------- Debian LTS 公告 DLA-4251-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/Guilhem Moulin 2025 年 7 月 26 日https://wiki.debian.org/LTS-------------------------------------------------------------------------

    程序包：libxml2 版本：2.9.10+dfsg-6.7+deb11u8 CVE ID：CVE-2024-34459 CVE-2025-6021 CVE-2025-6170 CVE-2025-49794 CVE-2025-49796 Debian 缺陷：1071162 1107720 1107755 1107938

    在 GNOME XML 库 libxml2 中发现了多个安全问题，这些问题可能导致拒绝服务，甚至可能执行任意代码。

    CVE-2024-34459

        Zhineng Zhong 发现包含“xmllint
        --htmlout”的格式错误消息可导致缓冲区过度读取。

    CVE-2025-6021

        Ahmed Lekssays 发现“xmlBuildQName()”中存在整数溢出问题，可能在处理构建的输入时导致内存损坏或拒绝服务。

    CVE-2025-6170

        Ahmed Lekssays 发现 xmllint 中交互式 shell 的命令解析逻辑中存在一个基于堆栈的缓冲区溢出问题。

    CVE-2025-49794

        Nikita Sveshnikov 在 schematron 中发现一个堆释放后使用问题。在处理 Schematron 模式元素“<sch:name path=/>”中的 XPath 表达式时，会返回一个指向已释放内存的指针，进而加以访问，从而导致不明行为或潜在的崩溃。

    CVE-2025-49796

        Nikita Sveshnikov 在 schematron 中发现一个类型混淆问题。处理“sch:name”元素并访问命名空间信息可能会导致内存损坏或未定义行为。

    对于 Debian 11 bullseye，已在 2.9.10+dfsg-6.7+deb11u8 版本中修复这些问题。

    我们建议您升级 libxml2 程序包。

    如需了解 libxml2 的详细安全状态，请参阅其安全跟踪页面：
    https://security-tracker.debian.org/tracker/libxml2

    有关 Debian LTS 安全公告、如何将这些更新应用到系统以及常见问题解答的更多信息，请访问以下网址：https://wiki.debian.org/LTSAttachment:signature.ascDescription: PGP signature

Tenable 已直接从 Debian 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Ubuntu 20.04 LTS/22.04 LTS/24.04 LTS 主机上安装的多个程序包受到 USN-7240-1 公告中提及的多个漏洞影响。

    据发现，libxml2 未正确处理某些内存操作。远程攻击者可利用此问题造成 libxml2 崩溃，从而导致拒绝服务或可能执行任意代码。(CVE-2022-49043)

    据发现，libxml2 xmllint 工具未正确处理某些内存操作。如果用户或自动化系统受到诱骗而在特制的 xml 文件上运行 xmllint，则远程攻击者可造成 xmllint 崩溃，进而导致拒绝服务。(CVE-2024-34459)

Tenable 已直接从 Ubuntu 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2288-1 advisory.

    - CVE-2024-34459: Fixed buffer over-read in xmlHTMLPrintFileContext in xmllint.c (bsc#1224282).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error     messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in     xmllint.c.(CVE-2024-34459)

Tenable has extracted the preceding description block directly from the EulerOS libxml2 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error     messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in     xmllint.c.(CVE-2024-34459)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libxml2 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:2267-1 advisory.

    - CVE-2024-34459: Fixed buffer over-read in xmlHTMLPrintFileContext in xmllint.c (bsc#1224282).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-af22a87e43 advisory.

    Unbundle libxml.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5949 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5949-1                   security@debian.org     https://www.debian.org/security/                                  Aron Xu     June 26, 2025                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : libxml2     CVE ID         : CVE-2022-49043 CVE-2023-39615 CVE-2023-45322 CVE-2024-25062                      CVE-2024-34459 CVE-2024-56171 CVE-2025-24928 CVE-2025-27113                      CVE-2025-32414 CVE-2025-32415     Debian Bug     : 1051230 1053629 1063234 1071162 1094238 1098320 1098321 1098322 1102521 1103511

    Brief introduction


    Multiple memory related vulnerabilities, inlcuding use-after-free,     out-of-bounds memory access and NULL pointer dereference, were discovered in     GNOME XML Parser and Toolkit Library and its Python bindings, which may cause     denial of service or other unintended behaviors.

    For the stable distribution (bookworm), these problems have been fixed in     version 2.9.14+dfsg-1.3~deb12u2.

    We recommend that you upgrade your libxml2 packages.

    For the detailed security status of libxml2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libxml2

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-783 advisory.

    An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error     messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.
    (CVE-2024-34459)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2717 advisory.

    An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error     messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.
    (CVE-2024-34459)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the libxml2 package has been released.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-4862425658 advisory.

    Update to 2.12.7 (RHBZ#2280535, CVE-2024-34459)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4251 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4251-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     July 26, 2025                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libxml2     Version        : 2.9.10+dfsg-6.7+deb11u8     CVE ID         : CVE-2024-34459 CVE-2025-6021 CVE-2025-6170 CVE-2025-49794                      CVE-2025-49796     Debian Bug     : 1071162 1107720 1107755 1107938

    Multiple security issues were found in libxml2, the GNOME XML library,     which could yield to denial of service or potentially arbitrary code     execution.

    CVE-2024-34459

        Zhineng Zhong discovered that formatting error messages with `xmllint
        --htmlout` could result in a buffer over-read.

    CVE-2025-6021

        Ahmed Lekssays discovered an integer overflow issue in         `xmlBuildQName()` which could result in memory corruption or a         denial of service when processing crafted input.

    CVE-2025-6170

        Ahmed Lekssays discovered a stack-based buffer overflow issue in the         command-parsing logic of the interactive shell in xmllint.

    CVE-2025-49794

        Nikita Sveshnikov discovered a heap use-after-free issue in the         schematron.  When processing XPath expressions in Schematron schema         elements `<sch:name path=/>`, a pointer to freed memory is         returned and then accessed, leading to undefined behavior or         potential crashes.

    CVE-2025-49796

        Nikita Sveshnikov discovered a type confusion issue in the         schematron.  Processing `sch:name` elements and accessing namespace         information may lead to leading to memory corruption or undefined         behavior.

    For Debian 11 bullseye, these problems have been fixed in version     2.9.10+dfsg-6.7+deb11u8.

    We recommend that you upgrade your libxml2 packages.

    For the detailed security status of libxml2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libxml2

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7240-1 advisory.

    It was discovered that libxml2 incorrectly handled certain memory operations. A remote attacker could use     this issue to cause libxml2 to crash, resulting in a denial of service, or possibly execute arbitrary     code. (CVE-2022-49043)

    It was discovered that the libxml2 xmllint tool incorrectly handled certain memory operations. If a user     or automated system were tricked into running xmllint on a specially crafted xml file, a remote attacker     could cause xmllint to crash, resulting in a denial of service. (CVE-2024-34459)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
242881	Debian dla-4251：libxml2 - 安全更新	Nessus	Debian Local Security Checks	2025/7/27	2025/10/3	low
214777	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS：libxml2 漏洞 (USN-7240-1)	Nessus	Ubuntu Local Security Checks	2025/1/29	2025/10/13	high
201873	SUSE SLES12 Security Update : libxml2 (SUSE-SU-2024:2288-1)	Nessus	SuSE Local Security Checks	2024/7/4	2025/10/13	high
205232	EulerOS 2.0 SP11 : libxml2 (EulerOS-SA-2024-2088)	Nessus	Huawei Local Security Checks	2024/8/8	2025/10/13	high
205244	EulerOS 2.0 SP11 : libxml2 (EulerOS-SA-2024-2105)	Nessus	Huawei Local Security Checks	2024/8/8	2025/10/13	high
205937	EulerOS Virtualization 2.11.0 : libxml2 (EulerOS-SA-2024-2183)	Nessus	Huawei Local Security Checks	2024/8/20	2025/10/13	high
201318	openSUSE 15 Security Update : libxml2 (SUSE-SU-2024:2267-1)	Nessus	SuSE Local Security Checks	2024/7/3	2025/10/13	high
232675	Fedora 40 : qt6-qtwebengine (2025-af22a87e43)	Nessus	Fedora Local Security Checks	2025/3/13	2025/3/13	high
240559	Debian dsa-5949 : libxml2 - security update	Nessus	Debian Local Security Checks	2025/6/26	2025/6/26	high
212356	Amazon Linux 2023 : libxml2, libxml2-devel, libxml2-static (ALAS2023-2024-783)	Nessus	Amazon Linux Local Security Checks	2024/12/11	2025/10/13	high
213363	Amazon Linux 2 : libxml2 (ALAS-2024-2717)	Nessus	Amazon Linux Local Security Checks	2024/12/23	2025/10/13	high
203565	Photon OS 4.0: Libxml2 PHSA-2024-4.0-0640	Nessus	PhotonOS Local Security Checks	2024/7/23	2025/10/13	high
208369	EulerOS 2.0 SP12 : libxml2 (EulerOS-SA-2024-2534)	Nessus	Huawei Local Security Checks	2024/10/9	2025/10/13	high
197915	Fedora 39 : mingw-libxml2 (2024-4862425658)	Nessus	Fedora Local Security Checks	2024/5/25	2025/10/13	high
204489	Photon OS 5.0: Libxml2 PHSA-2024-5.0-0304	Nessus	PhotonOS Local Security Checks	2024/7/24	2025/10/13	high
242881	Debian dla-4251 : libxml2 - security update	Nessus	Debian Local Security Checks	2025/7/27	2025/10/3	low
214777	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : libxml2 vulnerabilities (USN-7240-1)	Nessus	Ubuntu Local Security Checks	2025/1/29	2025/10/13	high

检测

插件搜索

low

high

high

high

high

high

high

high

high

high

high

high

high

high

high

low

high