The remote Solaris system is missing necessary patches to address security updates :

  - Off-by-one error in libxml in Apple Safari before 5.0.6     allows remote attackers to execute arbitrary code or     cause a denial of service (heap-based buffer overflow     and application crash) via a crafted web site.
    (CVE-2011-0216)

  - Double free vulnerability in libxml2, as used in Google     Chrome before 13.0.782.215, allows remote attackers to     cause a denial of service or possibly have unspecified     other impact via a crafted XPath expression.
    (CVE-2011-2821)

  - Double free vulnerability in libxml2, as used in Google     Chrome before 14.0.835.163, allows remote attackers to     cause a denial of service or possibly have unspecified     other impact via vectors related to XPath handling.
    (CVE-2011-2834)

  - Off-by-one error in libxml2, as used in Google Chrome     before 19.0.1084.46 and other products, allows remote     attackers to cause a denial of service (out-of-bounds     write) or possibly have unspecified other impact via     unknown vectors. (CVE-2011-3102)

  - libxml2, as used in Google Chrome before 16.0.912.63,     allows remote attackers to cause a denial of service     (out-of-bounds read) via unspecified vectors.
    (CVE-2011-3905)

  - Heap-based buffer overflow in libxml2, as used in Google     Chrome before 16.0.912.75, allows remote attackers to     cause a denial of service or possibly have unspecified     other impact via unknown vectors. (CVE-2011-3919)

  - libxml2 before 2.8.0 computes hash values without     restricting the ability to trigger hash collisions     predictably, which allows context-dependent attackers to     cause a denial of service (CPU consumption) via crafted     XML data. (CVE-2012-0841)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-10:01 advisory.

    This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML     files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse     time or later once the document has been modified. The output can be a simple SAX stream or and in-memory     DOM like representations. In this case one can use the built-in XPath and XPointer implementation to     select subnodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP     modules and combined to an URI library.
    Security issues fixed with this release:
    CVE-2010-4008     libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and     other products, reads from invalid memory locations during processing of malformed XPath expressions,     which allows context-dependent attackers to cause a denial of service (application crash) via a crafted     XML document.
    CVE-2010-4494     Double free vulnerability in libxml2 2.7.8 and other versions, as used in Google Chrome before 8.0.552.215     and other products, allows remote attackers to cause a denial of service or possibly have unspecified     other impact via vectors related to XPath handling.
    CVE-2011-0216     Off-by-one error in libxml in Apple Safari before 5.0.6 allows remote attackers to execute arbitrary code     or cause a denial of service (heap-based buffer overflow and application crash) via a crafted web site.
    CVE-2011-1944     Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and     earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute     arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new     namespace node, related to handling of XPath expressions.
    CVE-2011-2821     Double free vulnerability in libxml2, as used in Google Chrome before 13.0.782.215, allows remote     attackers to cause a denial of service or possibly have unspecified other impact via a crafted XPath     expression.
    CVE-2011-2834     Double free vulnerability in libxml2, as used in Google Chrome before 14.0.835.163, allows remote     attackers to cause a denial of service or possibly have unspecified other impact via vectors related to     XPath handling.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0217 advisory.

    - Added patch for CVE-2012-0841
    - Added patch for CVE-2011-0216
    - Added patch for CVE-2011-2834
    - Added patch for CVE-2011-3919
    - Added patch for CVE-2011-1944

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
80688	Oracle Solaris Third-Party Patch Update : libxml2 (cve_2011_0216_denial_of)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	high
284198	MiracleLinux 4 : libxml2-2.7.6-4.0.1.AXS4 (AXSA:2012-10:01)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	critical
51069	FreeBSD : chromium -- multiple vulnerabilities (6887828f-0229-11e0-b84d-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	2010/12/8	2021/1/6	critical
68721	Oracle Linux 6 : mingw32-libxml2 (ELSA-2013-0217)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	critical

检测

插件搜索

high

critical

critical

critical