The version of Google Chrome installed on the remote host is a version prior to 28.0.1500.71 and is, therefore, affected by multiple vulnerabilities :

  - A vulnerability exists that exposes HTTP in SSL to a     man-in-the-middle attack. (CVE-2013-2853)

  - Block pop-unders in various scenarios. (CVE-2013-2867)

  - An error exists related to an incorrect sync of the     NPAPI extension component. (CVE-2013-2868)

  - An unspecified flaw exists due to a lack of entropy in     renderers. (CVE-2013-2872)

  - Use-after-free errors exist related to network sockets,     input handling, and resource loading. (CVE-2013-2870,     CVE-2013-2871, CVE-2013-2873)

  - A screen data leak error exists related to GL textures.
    (CVE-2013-2874)

  - An extension permission error exists related to     interstitials.  (CVE-2013-2876)

  - Multiple out-of-bounds errors exist related to JPEG2000,     SVG, text handling and XML parsing.  (CVE-2013-2869,     CVE-2013-2875, CVE-2013-2877, CVE-2013-2878)

  - An unspecified error exists when setting up sign-in and     sync. (CVE-2013-2879)

  - The vendor reports various, unspecified errors exist.
    (CVE-2013-2880)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-350:02 advisory.

    This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML     files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse     time or later once the document has been modified. The output can be a simple SAX stream or and in-memory     DOM like representations. In this case one can use the built-in XPath and XPointer implementation to     select subnodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP     modules and combined to an URI library.
    Security issues fixed with this release:
     CVE-2013-2877      parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows     remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly,     related to the lack of certain checks for the XML_PARSER_EOF state.
     CVE-2014-0191      No information available at the time of writing, please refer to the CVE link below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote VMware ESXi host is version 5.1 prior to build 2323236. It is, therefore, affected by the following vulnerabilities in bundled third-party libraries :

  - Multiple vulnerabilities exist in the bundled Python     library. (CVE-2011-3389, CVE-2012-0845, CVE-2012-0876,     CVE-2012-1150, CVE-2013-1752, CVE-2013-4238)

  - Multiple vulnerabilities exist in the bundled GNU C     Library (glibc). (CVE-2013-0242, CVE-2013-1914,     CVE-2013-4332)

  - Multiple vulnerabilities exist in the bundled XML     Parser library (libxml2). (CVE-2013-2877, CVE-2014-0191)

  - Multiple vulnerabilities exist in the bundled cURL     library (libcurl). (CVE-2014-0015, CVE-2014-0138)

The remote VMware ESXi host is affected by multiple vulnerabilities :

  - Multiple denial of service vulnerabilities exist in     Python function _read_status() in library httplib and     in function readline() in libraries smtplib, ftplib,     nntplib, imaplib, and poplib. A remote attacker can     exploit these vulnerabilities to crash the module.
    (CVE-2013-1752)

  - A out-of-bounds read error exists in file parser.c in     library libxml2 due to a failure to properly check the     XML_PARSER_EOF state. An unauthenticated, remote     attacker can exploit this, via a crafted document that     abruptly ends, to cause a denial of service.
    (CVE-2013-2877)

  - A spoofing vulnerability exists in the Python SSL module     in the ssl.match_hostname() function due to improper     handling of the NULL character ('\0') in a domain name     in the Subject Alternative Name field of an X.509     certificate. A man-in-the-middle attacker can exploit     this, via a crafted certificate issued by a legitimate     certification authority, to spoof arbitrary SSL servers.
    (CVE-2013-4238)

  - cURL and libcurl are affected by a flaw related to the     re-use of NTLM connections whenever more than one     authentication method is enabled. An unauthenticated,     remote attacker can exploit this, via a crafted request,     to connect and impersonate other users. (CVE-2014-0015)

  - The default configuration in cURL and libcurl reuses the     SCP, SFTP, POP3, POP3S, IMAP, IMAPS, SMTP, SMTPS, LDAP,     and LDAPS connections. An unauthenticated, remote     attacker can exploit this, via a crafted request, to     connect and impersonate other users. (CVE-2014-0138)

  - A flaw exists in the xmlParserHandlePEReference()     function in file parser.c in libxml2 due to loading     external entities regardless of entity substitution or     validation being enabled. An unauthenticated, remote     attacker can exploit this, via a crafted XML document,     to exhaust resources, resulting in a denial of service.
    (CVE-2014-0191)

It was discovered that libxml2 would load XML external entities by default. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly obtain access to arbitrary files or cause resource consumption. This issue only affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS, and Ubuntu 12.10.
(CVE-2013-0339)

It was discovered that libxml2 incorrectly handled documents that end abruptly. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to crash, resulting in a denial of service. (CVE-2013-2877).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0513 advisory.

    The libxml2 library is a development toolbox providing the implementation     of various XML standards.

    It was discovered that libxml2 loaded external parameter entities even when     entity substitution was disabled. A remote attacker able to provide a     specially crafted XML file to an application linked against libxml2 could     use this flaw to conduct XML External Entity (XXE) attacks, possibly     resulting in a denial of service or an information leak on the system.
    (CVE-2014-0191)

    An out-of-bounds read flaw was found in the way libxml2 detected the end of     an XML file. A remote attacker could provide a specially crafted XML file     that, when processed by an application linked against libxml2, could cause     the application to crash. (CVE-2013-2877)

    The CVE-2014-0191 issue was discovered by Daniel P. Berrange of Red Hat.

    All libxml2 users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. The desktop must be     restarted (log out, then log back in) for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the remote Junos device is affected by multiple vulnerabilities in the libxml2 library :

  - A heap-based buffer overflow vulnerability exists which     can result in arbitrary code execution. (CVE-2011-1944)

  - A denial of service vulnerability exists which can     result in excessive CPU consumption. (CVE-2012-0841)

  - A heap-based buffer overflow vulnerability exists in     the 'xmlParseAttValueComplex' function which can result     in arbitrary code execution. (CVE-2012-5134)

  - A denial of service vulnerability exists due to     excessive CPU and memory consumption in the processing     of XML files containing entity declarations with long     replacement text (also known as 'internal entity     expansion with linear complexity'). (CVE-2013-0338)

  - A denial of service vulnerability exists related to the     XML_PARSER_EOF state checking. (CVE-2013-2877)

These vulnerabilities can be exploited by a remote attacker via a specially crafted XML file.

Google Chrome Releases reports :

A special reward for Andrey Labunets for his combination of CVE-2013-2879 and CVE-2013-2868 along with some (since fixed) server-side bugs.

[252216] Low CVE-2013-2867: Block pop-unders in various scenarios.

[252062] High CVE-2013-2879: Confusion setting up sign-in and sync.
Credit to Andrey Labunets.

[252034] Medium CVE-2013-2868: Incorrect sync of NPAPI extension component. Credit to Andrey Labunets.

[245153] Medium CVE-2013-2869: Out-of-bounds read in JPEG2000 handling. Credit to Felix Groebert of Google Security Team.

[244746] [242762] Critical CVE-2013-2870: Use-after-free with network sockets. Credit to Collin Payne.

[244260] Medium CVE-2013-2853: Man-in-the-middle attack against HTTP in SSL. Credit to Antoine Delignat-Lavaud and Karthikeyan Bhargavan from Prosecco at INRIA Paris.

[243991] [243818] High CVE-2013-2871: Use-after-free in input handling. Credit to miaubiz.

[Mac only] [242702] Low CVE-2013-2872: Possible lack of entropy in renderers. Credit to Eric Rescorla.

[241139] High CVE-2013-2873: Use-after-free in resource loading.
Credit to miaubiz.

[233848] Medium CVE-2013-2875: Out-of-bounds-read in SVG. Credit to miaubiz.

[229504] Medium CVE-2013-2876: Extensions permissions confusion with interstitials. Credit to Dev Akhawe.

[229019] Low CVE-2013-2877: Out-of-bounds read in XML parsing. Credit to Aki Helin of OUSPG.

[196636] None: Remove the 'viewsource' attribute on iframes. Credit to Collin Jackson.

[177197] Medium CVE-2013-2878: Out-of-bounds read in text handling.
Credit to Atte Kettunen of OUSPG.

This update fixes a DoS vulnerability in libxml2. CVE-2013-2877 has been assigned to this issue.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Update doc/redhat.gif in tarball

  - Add libxml2-oracle-enterprise.patch and update logos in     tarball

  - CVE-2014-3660 denial of service via recursive entity     expansion (rhbz#1149085)

  - Fix a set of regressions introduced in CVE-2014-0191     (rhbz#1105011)

  - Improve handling of xmlStopParser(CVE-2013-2877)

  - Do not fetch external parameter entities (CVE-2014-0191)

  - Fix a regression in 2.9.0 breaking validation while     streaming (rhbz#863166)

  - detect and stop excessive entities expansion upon     replacement (rhbz#912575)

Multiple vulnerabilities has been discovered and corrected in libxml2 :

A denial of service flaw was found in the way libxml2, a library providing support to read, modify and write XML and HTML files, performed string substitutions when entity values for external entity references replacement (--noent option) was requested / enabled during the XML file parsing. A remote attacker could provide a specially crafted XML file containing an external entity expansion, when processed would lead to excessive CPU consumption (denial of service) (CVE-2013-0339). This a different flaw from CVE-2013-0338.

parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state (CVE-2013-2877).

The updated packages have been patched to correct these issues.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
67232	Google Chrome < 28.0.1500.71 Multiple Vulnerabilities	Nessus	Windows	2013/7/10	2026/5/19	high
289428	MiracleLinux 4 : libxml2-2.7.6-14.1.0.2.AXS4 (AXSA:2014-350:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
79862	ESXi 5.1 < Build 2323236 Third-Party Libraries Multiple Vulnerabilities (remote check) (BEAST)	Nessus	Misc.	2014/12/12	2022/12/5	medium
87681	VMware ESXi Multiple Vulnerabilities (VMSA-2014-0012)	Nessus	Misc.	2015/12/30	2021/1/6	medium
68903	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : libxml2 vulnerabilities (USN-1904-1)	Nessus	Ubuntu Local Security Checks	2013/7/16	2019/9/19	medium
74102	RHEL 6 : libxml2 (RHSA-2014:0513)	Nessus	Red Hat Local Security Checks	2014/5/20	2024/11/4	critical
80957	Juniper Junos libxml2 Library Multiple Vulnerabilities (JSA10669)	Nessus	Junos Local Security Checks	2015/1/23	2018/7/12	high
67237	FreeBSD : chromium -- multiple vulnerabilities (3b80104f-e96c-11e2-8bac-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	2013/7/11	2021/1/6	high
72198	SuSE 11.2 / 11.3 Security Update : libxml2 (SAT Patch Numbers 8713 / 8714)	Nessus	SuSE Local Security Checks	2014/1/29	2021/1/19	medium
79546	OracleVM 3.3 : libxml2 (OVMSA-2014-0031)	Nessus	OracleVM Local Security Checks	2014/11/26	2021/1/4	medium
69053	Mandriva Linux Security Advisory : libxml2 (MDVSA-2013:198)	Nessus	Mandriva Local Security Checks	2013/7/25	2021/1/6	medium
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	2023/6/30	2023/7/6	critical

检测

插件搜索

high

critical

medium

medium

medium

critical

high

high

medium

medium

medium

critical