The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:10630 advisory.

    * libxml: Heap use after free (UAF) leads to Denial of service (DoS) (CVE-2025-49794)
      * libxml: Null pointer dereference leads to Denial of service (DoS) (CVE-2025-49795)
      * libxml: Type confusion leads to Denial of service (DoS) (CVE-2025-49796)
      * libxml2: Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2 (CVE-2025-6021)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1103 advisory.

    libxml: Heap use after free (UAF) leads to Denial of service (DoS) (CVE-2025-49794)

    libxml: Null pointer dereference leads to Denial of service (DoS) (CVE-2025-49795)

    libxml: Type confusion leads to Denial of service (DoS) (CVE-2025-49796)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10630 advisory.

    The libxml2 library is a development toolbox providing the implementation of various XML standards.

    Security Fix(es):

    * libxml: Heap use after free (UAF) leads to Denial of service (DoS) (CVE-2025-49794)

    * libxml: Null pointer dereference leads to Denial of service (DoS) (CVE-2025-49795)

    * libxml: Type confusion leads to Denial of service (DoS) (CVE-2025-49796)

    * libxml2: Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2 (CVE-2025-6021)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02260-1 advisory.

    - CVE-2025-49794: Fixed a heap use after free which could lead to denial of service. (bsc#1244554)
    - CVE-2025-49796: Fixed type confusion which could lead to denial of service. (bsc#1244557)
    - CVE-2025-49795: Fixed a null pointer dereference which could lead to denial of service. (bsc#1244555)
    - CVE-2025-6170: Fixed a stack buffer overflow which could lead to a crash. (bsc#1244700)
    - CVE-2025-6021: Fixed an integer overflow in xmlBuildQName() which could lead to stack buffer overflow.
    (bsc#1244590)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ55266. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ55266 advisory.

  - A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can     trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that     can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to     sensitive data being corrupted in memory. (CVE-2025-49796)

  - A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under     certain circumstances when the XML schematron has the <sch:name path=.../> schema elements. This flaw     allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the     program's crash using libxml or other possible undefined behaviors. (CVE-2025-49794)

  - A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This     flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.
    (CVE-2025-49795)

  - A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations     can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of     service when processing crafted input. (CVE-2025-6021)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ55267. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ55267 advisory.

  - A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can     trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that     can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to     sensitive data being corrupted in memory. (CVE-2025-49796)

  - A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under     certain circumstances when the XML schematron has the <sch:name path=.../> schema elements. This flaw     allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the     program's crash using libxml or other possible undefined behaviors. (CVE-2025-49794)

  - A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This     flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.
    (CVE-2025-49795)

  - A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations     can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of     service when processing crafted input. (CVE-2025-6021)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of MySQL Cluster installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory.

  - Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General (libxml2)). Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized creation, deletion or     modification access to critical data or all MySQL Cluster accessible data and unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Cluster. (CVE-2025-49796)

  - Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General (curl)). Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Cluster.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Cluster. (CVE-2025-5399)

  - Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General (Requests)). Difficult to     exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Cluster executes     to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker.
    Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to     critical data or all MySQL Cluster accessible data as well as unauthorized access to critical data or complete access     to all MySQL Cluster accessible data. (CVE-2024-35195)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0527 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-6021:
    A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations     can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of     service when processing crafted input.

    CVE-2025-49795:
    A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This     flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.

    CVE-2025-49794:
    A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under     certain circumstances when the XML schematron has the <sch:name path=.../> schema elements. This flaw     allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the     program's crash using libxml or other possible undefined behaviors.

    CVE-2025-32415:
    In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-     based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema     with certain identity constraints, or a crafted XML schema must be used.

    CVE-2025-32414:
    In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API     (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and     xmlPythonFileReadRaw because of a difference between bytes and characters.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libxml2 installed on the remote host is prior to 2.11.9. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-196-02 advisory.

    New libxml2 packages are available for Slackware 15.0 to fix security issues.

Tenable has extracted the preceding description block directly from the libxml2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ55269. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ55269 advisory.

  - A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can     trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that     can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to     sensitive data being corrupted in memory. (CVE-2025-49796)

  - A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under     certain circumstances when the XML schematron has the <sch:name path=.../> schema elements. This flaw     allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the     program's crash using libxml or other possible undefined behaviors. (CVE-2025-49794)

  - A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This     flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.
    (CVE-2025-49795)

  - A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations     can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of     service when processing crafted input. (CVE-2025-6021)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the libxml2 package has been released.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:10630 advisory.

    * libxml: Heap use after free (UAF) leads to Denial of service (DoS) (CVE-2025-49794)

    * libxml: Null pointer dereference leads to Denial of service (DoS) (CVE-2025-49795)

    * libxml: Type confusion leads to Denial of service (DoS) (CVE-2025-49796)

    * libxml2: Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2 (CVE-2025-6021)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
269903	AlmaLinux 10 : libxml2 (ALSA-2025:10630)	Nessus	Alma Linux Local Security Checks	2025/10/9	2025/10/9	critical
243464	Amazon Linux 2023 : libxml2, libxml2-devel, libxml2-static (ALAS2023-2025-1103)	Nessus	Amazon Linux Local Security Checks	2025/8/4	2026/1/21	critical
241600	RHEL 10 : libxml2 (RHSA-2025:10630)	Nessus	Red Hat Local Security Checks	2025/7/9	2026/1/21	critical
241674	SUSE SLED15 / SLES15 Security Update : libxml2 (SUSE-SU-2025:02260-1)	Nessus	SuSE Local Security Checks	2025/7/10	2026/1/21	low
242257	AIX : Multiple Vulnerabilities (IJ55266)	Nessus	AIX Local Security Checks	2025/7/17	2025/7/17	critical
242259	AIX : Multiple Vulnerabilities (IJ55267)	Nessus	AIX Local Security Checks	2025/7/17	2025/7/17	critical
271392	Oracle MySQL Cluster 8.0.x < 8.0.44 (October 2025 CPU)	Nessus	Databases	2025/10/24	2026/2/24	critical
275895	TencentOS Server 4: libxml2 (TSSA-2025:0527)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	high
242145	Slackware Linux 15.0 libxml2 Multiple Vulnerabilities (SSA:2025-196-02)	Nessus	Slackware Local Security Checks	2025/7/16	2026/1/21	low
242258	AIX : Multiple Vulnerabilities (IJ55269)	Nessus	AIX Local Security Checks	2025/7/17	2025/7/17	critical
242404	Photon OS 5.0: Libxml2 PHSA-2025-5.0-0562	Nessus	PhotonOS Local Security Checks	2025/7/19	2026/1/21	critical
271393	Oracle MySQL Cluster 8.4.x < 8.4.7 (October 2025 CPU)	Nessus	Databases	2025/10/24	2026/2/24	critical
266633	RockyLinux 10 : libxml2 (RLSA-2025:10630)	Nessus	Rocky Linux Local Security Checks	2025/10/6	2025/10/6	critical
271394	Oracle MySQL Cluster 9.x.x < 9.5.0 (October 2025 CPU)	Nessus	Databases	2025/10/24	2026/2/24	critical

检测

插件搜索

critical

critical

critical

low

critical

critical

critical

high

low

critical

critical

critical

critical

critical