The version of IBM HTTP Server running on the remote host is affected by multiple vulnerabilities related to Apache HTTP Server, as follows:

  - Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows     context-dependent attackers to cause a denial of service (memory consumption) via a large number of     crafted XML files that cause improperly-handled reallocation failures when expanding entities.
    (CVE-2012-1148)

  - The overflow protection in Expat is removed by compilers with certain optimization settings, which allows     remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML     data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.
    (CVE-2016-4472)

  - Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute     arbitrary code via a malformed input document, which triggers a buffer overflow. (CVE-2016-0718)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5455-1 advisory.

    Tim Boddy, Gustavo Grieco and others discovered that Expat, that is integrated in xmltok library,     incorrectly handled certain files. An attacker could possibly use these issues to cause a denial of     service, or possibly execute arbitrary code. These issues were only addressed in Ubuntu 16.04 ESM.
    (CVE-2012-1148, CVE-2015-1283, CVE-2016-0718, CVE-2016-4472, CVE-2018-20843, CVE-2019-15903,     CVE-2021-46143, CVE-2022-22822, CVE-2022-22823, CVE-2022-22824, CVE-2022-22825, CVE-2022-22826,     CVE-2022-22827)

    It was discovered that Expat, that is integrated in xmltok library, incorrectly handled encoding     validation of certain files. An attacker could possibly use this issue to cause a denial of service, or     possibly execute arbitrary code. (CVE-2022-25235)

    It was discovered that Expat, that is integrated in xmltok library, incorrectly handled namespace URIs of     certain files. An attacker could possibly use this issue to cause a denial of service, or possibly execute     arbitrary code. (CVE-2022-25236)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that Expat, a C library to parse XML, is vulnerable to denial of service through hash collisions and a memory leak in pool handling.

a. VMware vSphere API denial of service vulnerability

   The VMware vSphere API contains a denial of service    vulnerability.  This issue allows an unauthenticated user to    send a maliciously crafted API request and disable the host    daemon. Exploitation of the issue would prevent management    activities on the host but any virtual machines running on the    host would be unaffected.

   VMware would like to thank Sebastian Tello of Core Security    Technologies for reporting this issue to us.
    The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-5703 to this issue.

b. Update to ESX service console bind packages

   The ESX service console bind packages are updated to the    following versions :

       bind-libs-9.3.6-20.P1.el5_8.2        bind-utils-9.3.6-20.P1.el5_8.2

   These updates fix multiple security issues. The Common    Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2012-1033, CVE-2012-1667, and    CVE-2012-3817 to these issues.

c. Update to ESX service console python packages

   The ESX service console Python packages are updated to the    following versions :

       python-2.4.3-46.el5_8.2.x86_64        python-libs-2.4.3-46.el5_8.2.x86_64      These updates fix multiple security issues. The Common    Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2011-4940, CVE-2011-4944, and    CVE-2012-1150 to these issues.

d. Update to ESX service console expat package

   The ESX service console expat package is updated to    expat-1.95.8-11.el5_8.

   This update fixes multiple security issues. The Common    Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2012-0876 and CVE-2012-1148 to these    issues.

e. Update to ESX service console nspr and nss packages

   This patch updates the ESX service console Netscape Portable    Runtime and Network Security Services RPMs to versions    nspr-4.9.1.4.el5_8 and nss-3.13.5.4.9834, respectively, to    resolve multiple security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-0441 to this issue. This patch    also resolves a certificate trust issue caused by a fraudulent    DigiNotar root certificate.

A denial of service flaw was found in the implementation of hash arrays in Expat. An attacker could use this flaw to make an application using Expat consume an excessive amount of CPU time by providing a specially crafted XML file that triggers multiple hash function collisions. To mitigate this issue, randomization has been added to the hash function to reduce the chance of an attacker successfully causing intentional collisions. (CVE-2012-0876)

A memory leak flaw was found in Expat. If an XML file processed by an application linked against Expat triggered a memory re-allocation failure, Expat failed to free the previously allocated memory. This could cause the application to exit unexpectedly or crash when all available memory is exhausted. (CVE-2012-1148)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7307-1 advisory.

    Tim Boddy discovered that Expat, contained within the xmltok library, did not properly handle memory     reallocation when processing XML files. If a user or application linked against Expat were tricked into     opening a crafted XML file, an attacker could cause a denial of service by consuming excessive memory     resources.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-     dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML     files that cause improperly-handled reallocation failures when expanding entities. (CVE-2012-1148)

Note that Nessus relies on the presence of the package as reported by the vendor.

Updated expat packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Expat is a C library written by James Clark for parsing XML documents.

A denial of service flaw was found in the implementation of hash arrays in Expat. An attacker could use this flaw to make an application using Expat consume an excessive amount of CPU time by providing a specially crafted XML file that triggers multiple hash function collisions. To mitigate this issue, randomization has been added to the hash function to reduce the chance of an attacker successfully causing intentional collisions. (CVE-2012-0876)

A memory leak flaw was found in Expat. If an XML file processed by an application linked against Expat triggered a memory re-allocation failure, Expat failed to free the previously allocated memory. This could cause the application to exit unexpectedly or crash when all available memory is exhausted. (CVE-2012-1148)

All Expat users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, applications using the Expat library must be restarted for the update to take effect.

The following issues have been fixed :

  - expat was prone to a hash collision attack that could     lead to excessive CPU usage. (CVE-2012-0876)

  - expat didn't close file descriptors in some cases.
    (CVE-2012-1147)

  - specially crafted XML files could lead to a memory leak.
    (CVE-2012-1148)

USN-1527-1 fixed vulnerabilities in Expat. This update provides the corresponding updates for XML-RPC for C and C++. Both issues described in the original advisory affected XML-RPC for C and C++ in Ubuntu 10.04 LTS, 11.04, 11.10 and 12.04 LTS.

It was discovered that Expat computed hash values without restricting the ability to trigger hash collisions predictably. If a user or application linked against Expat were tricked into opening a crafted XML file, an attacker could cause a denial of service by consuming excessive CPU resources. (CVE-2012-0876)

Tim Boddy discovered that Expat did not properly handle memory reallocation when processing XML files. If a user or application linked against Expat were tricked into opening a crafted XML file, an attacker could cause a denial of service by consuming excessive memory resources. This issue only affected Ubuntu 8.04 LTS, 10.04 LTS, 11.04 and 11.10.
(CVE-2012-1148).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of expat fixes the following bugs :

  - hash collision attack that could lead to exessive CPU     usage. (CVE-2012-0876)

  - expat didn't close file descriptors in some cases.
    (CVE-2012-1147)

  - specially crafted xml files could lead to a memory leak     (CVE-2012-1148)

The remote Solaris system is missing necessary patches to address security updates :

  - The XML parser (xmlparse.c) in expat before 2.1.0     computes hash values without restricting the ability to     trigger hash collisions predictably, which allows     context-dependent attackers to cause a denial of service     (CPU consumption) via an XML file with many identifiers     with the same value. (CVE-2012-0876)

  - Memory leak in the poolGrow function in     expat/lib/xmlparse.c in expat before 2.1.0 allows     context-dependent attackers to cause a denial of service     (memory consumption) via a large number of crafted XML     files that cause improperly-handled reallocation     failures when expanding entities. (CVE-2012-1148)

The version of Apple iTunes installed on the remote Windows host is prior to 12.6. It is, therefore, affected by multiple vulnerabilities :

  - Multiple vulnerabilities exist in the expat component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2009-3270,     CVE-2009-3560, CVE-2009-3720, CVE-2012-1147,     CVE-2012-1148, CVE-2012-6702, CVE-2015-1283,     CVE-2016-0718, CVE-2016-4472, CVE-2016-5300)

  - Multiple vulnerabilities exist in the SQLite component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities by convincing a user to     open a specially crafted file, to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2013-7443,     CVE-2015-3414, CVE-2015-3415, CVE-2015-3416,     CVE-2015-3717, CVE-2015-6607, CVE-2016-6153)

  - An information disclosure vulnerability exists in the     APNs server component due to client certificates being     transmitted in cleartext. A man-in-the-middle attacker     can exploit this to disclose sensitive information.
    (CVE-2017-2383)

  - A use-after-free error exists in the WebKit component     due to improper handling of RenderBox objects. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-2463)

  - Multiple universal cross-site scripting (XSS)     vulnerabilities exist in the WebKit component due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these     vulnerabilities, by convincing a user to visit a     specially crafted web page, to execute arbitrary script     code in a user's browser session. (CVE-2017-2479,     CVE-2017-2480, CVE-2017-2493)

  - An integer overflow condition exists in the libxslt     component in the xsltAddTextString() function in     transform.c due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause an out-of-bounds write, resulting in the     execution of arbitrary code. (CVE-2017-5029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
145061	IBM HTTP Server 7.0.0.0 <= 7.0.0.41 / 8.0.0.0 < 8.0.0.13 / 8.5.0.0 < 8.5.5.11 / 9.0.0.0 < 9.0.0.2 Multiple Vulnerabilities (548231)	Nessus	Web Servers	2021/1/19	2022/4/11	critical
183151	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : xmltok library vulnerabilities (USN-5455-1)	Nessus	Ubuntu Local Security Checks	2023/10/16	2024/8/28	critical
61441	Debian DSA-2525-1 : expat - several vulnerabilities	Nessus	Debian Local Security Checks	2012/8/7	2021/1/11	medium
62944	VMSA-2012-0016 : VMware security updates for vSphere API and ESX Service Console	Nessus	VMware ESX Local Security Checks	2012/11/16	2021/1/6	high
69696	Amazon Linux AMI : expat (ALAS-2012-89)	Nessus	Amazon Linux Local Security Checks	2013/9/4	2018/4/18	medium
216880	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : xmltok library vulnerability (USN-7307-1)	Nessus	Ubuntu Local Security Checks	2025/2/27	2025/3/4	high
217585	Linux Distros Unpatched Vulnerability : CVE-2012-1148	Nessus	Misc.	2025/3/4	2026/2/3	high
59491	RHEL 5 / 6 : expat (RHSA-2012:0731)	Nessus	Red Hat Local Security Checks	2012/6/14	2021/1/14	medium
59639	SuSE 10 Security Update : expat (ZYPP Patch Number 8015)	Nessus	SuSE Local Security Checks	2012/6/21	2021/1/19	medium
62036	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : xmlrpc-c vulnerabilities (USN-1527-2)	Nessus	Ubuntu Local Security Checks	2012/9/11	2019/9/19	medium
64127	SuSE 11.1 Security Update : expat (SAT Patch Number 6200)	Nessus	SuSE Local Security Checks	2013/1/25	2021/1/19	medium
80669	Oracle Solaris Third-Party Patch Update : libexpat (multiple_resource_management_error_vulnerabilities)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	medium
100025	Apple iTunes < 12.6 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	2017/5/8	2019/11/13	critical

检测

插件搜索

critical

critical

medium

high

medium

high

high

medium

medium

medium

medium

medium

critical