This update for libxml2 fixes the following security issues :

  - CVE-2016-2073, CVE-2015-8806, CVE-2016-1839: A     Heap-buffer overread was fixed in libxml2/dict.c     [bsc#963963, bsc#965283, bsc#981114].

  - CVE-2016-4483: Code was added to avoid an out of bound     access when serializing malformed strings [bsc#978395].

  - CVE-2016-1762: Fixed a heap-based buffer overread in     xmlNextChar [bsc#981040].

  - CVE-2016-1834: Fixed a heap-buffer-overflow in     xmlStrncat [bsc#981041].

  - CVE-2016-1833: Fixed a heap-based buffer overread in     htmlCurrentChar [bsc#981108].

  - CVE-2016-1835: Fixed a heap use-after-free in     xmlSAX2AttributeNs [bsc#981109].

  - CVE-2016-1837: Fixed a heap use-after-free in     htmlParsePubidLiteral and htmlParseSystemiteral     [bsc#981111].

  - CVE-2016-1838: Fixed a heap-based buffer overread in     xmlParserPrintFileContextInternal [bsc#981112].

  - CVE-2016-1840: Fixed a heap-buffer-overflow in     xmlFAParsePosCharGroup [bsc#981115].

  - CVE-2016-4447: Fixed a heap-based buffer-underreads due     to xmlParseName [bsc#981548].

  - CVE-2016-4448: Fixed some format string warnings with     possible format string vulnerability [bsc#981549],

  - CVE-2016-4449: Fixed inappropriate fetch of entities     content [bsc#981550].

  - CVE-2016-3705: Fixed missing increment of recursion     counter.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tenable Log Correlation Engine (LCE) installed on the remote host is prior to 4.8.1. It is, therefore, affected by the following vulnerabilities :

  - Multiple cross-site scripting (XSS) vulnerabilities     exist in the Handlebars library in the     lib/handlebars/utils.js script due to a failure to     properly escape input passed as unquoted attributes to     templates. An unauthenticated, remote attacker can     exploit these vulnerabilities, via a specially crafted     request, to execute arbitrary script code in a user's     browser session. (CVE-2015-8861, CVE-2015-8862)

  - A heap-based buffer overflow condition exists in the     Perl-Compatible Regular Expressions (PCRE) component     that is triggered when processing nested back references     in a duplicate named group. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1283)

  - An out-of-bounds read error exists in the libxml2     component in parserInternals.c due to improper parsing     of characters in an XML file. An unauthenticated, remote     attacker can exploit this to disclose sensitive     information or cause a denial of service condition.
    (CVE-2016-1833)

  - An overflow condition exists in the libxml2 component in     xmlstring.c due to improper validation of user-supplied     input when handling a string with NULL. An     unauthenticated, remote attacker can exploit this, via a     specially crafted file, to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1834)

  - Multiple use-after-free errors exist in the libxml2     component in parser.c that is triggered when parsing     complex names. An unauthenticated, remote attacker can     exploit these issues, via a specially crafted file, to     dereference already freed memory and potentially execute     arbitrary code. (CVE-2016-1835, CVE-2016-1836)

  - Multiple heap-based buffer overflow conditions exist in     the libxml2 component in HTMLparser.c and xmlregexp.c     due to improper validation of user-supplied input when     parsing characters in a range. An unauthenticated,     remote attacker can exploit these issues, via a     specially crafted file, to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1837, CVE-2016-1839, CVE-2016-1840)

  - Multiple out-of-bounds read errors exist in the libxml2     component in parser.c. An unauthenticated, remote     attacker can exploit these issues to disclose sensitive     information or cause a denial of service condition.
    (CVE-2016-1838, CVE-2016-4447)

  - A heap buffer overflow condition exists in the OpenSSL     component in the EVP_EncodeUpdate() function within file     crypto/evp/encode.c that is triggered when handling a     large amount of input data. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition. (CVE-2016-2105)

  - A heap buffer overflow condition exists in the OpenSSL     component in the EVP_EncryptUpdate() function within     file crypto/evp/evp_enc.c that is triggered when     handling a large amount of input data after a previous     call occurs to the same function with a partial block.
    An unauthenticated, remote attacker can exploit this to     cause a denial of service condition. (CVE-2016-2106)

  - Flaws exist in the aesni_cbc_hmac_sha1_cipher()     function in file crypto/evp/e_aes_cbc_hmac_sha1.c and     the aesni_cbc_hmac_sha256_cipher() function in file     crypto/evp/e_aes_cbc_hmac_sha256.c that are triggered     when the connection uses an AES-CBC cipher and AES-NI     is supported by the server. A man-in-the-middle attacker     can exploit these to conduct a padding oracle attack,     resulting in the ability to decrypt the network traffic.
    (CVE-2016-2107)

  - A remote code execution vulnerability exists in the     OpenSSL component in the ASN.1 encoder due to an     underflow condition that occurs when attempting to     encode the value zero represented as a negative integer.
    An unauthenticated, remote attacker can exploit this to     corrupt memory, resulting in the execution of arbitrary     code. (CVE-2016-2108)

  - Multiple unspecified flaws exist in the d2i BIO     functions when reading ASN.1 data from a BIO due to     invalid encoding causing a large allocation of memory.
    An unauthenticated, remote attacker can exploit these to     cause a denial of service condition through resource     exhaustion. (CVE-2016-2109)

  - An out-of-bounds read error exists in the     X509_NAME_oneline() function within file     crypto/x509/x509_obj.c when handling very long ASN1     strings. An unauthenticated, remote attacker can exploit     this to disclose the contents of stack memory.
    (CVE-2016-2176)

  - An overflow condition exists in the Perl-Compatible     Regular Expressions (PCRE) component due to improper     validation of user-supplied input when handling the     (*ACCEPT) verb. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition or     the execution of arbitrary code. (CVE-2016-3191)

  - A flaw exists in the libxml2 component in parser.c that     occurs when handling XML content in recovery mode. An     unauthenticated, remote attacker can exploit this to     cause a stack exhaustion, resulting in a denial of     service condition. (CVE-2016-3627)

  - A flaw exists in the libxml2 component in parser.c due     to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a stack exhaustion, resulting in a denial of     service condition. (CVE-2016-3705)

  - A format string flaw exists in the libxml2 component due     to improper use of string format specifiers (e.g. %s and     %x). An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     execution of arbitrary code. (CVE-2016-4448)

  - An XML external entity injection vulnerability exists in     parser.c due to improper parsing of XML data. An     unauthenticated, remote attacker can exploit this, via     specially crafted XML data, to disclose arbitrary files     or cause a denial of service condition. (CVE-2016-4449)

  - An out-of-bounds read error exists in the libxml2     component in xmlsave.c that occurs when handling XML     content in recovery mode. An unauthenticated, remote     attacker can exploit this to disclose sensitive     information or cause a denial of service condition.
    (CVE-2016-4483)

  - A security bypass vulnerability exists in the libcurl     component due to the program attempting to resume TLS     sessions even if the client certificate fails. An     unauthenticated, remote attacker can exploit this to     bypass validation mechanisms. (CVE-2016-5419)

  - An information disclosure vulnerability exists in the     libcurl component due to the program reusing TLS     connections with different client certificates. An     unauthenticated, remote attacker can exploit this to     disclose sensitive cross-realm information.
    (CVE-2016-5420)

  - A use-after-free error exists in the libcurl component     that is triggered as connection pointers are not     properly cleared for easy handles. An unauthenticated,     remote attacker can exploit this to dereference already     freed memory, potentially resulting in the execution of     arbitrary code. (CVE-2016-5421)

  - Multiple stored cross-site scripting (XSS)   	vulnerabilities exist due to improper validation of   	user-supplied input. An authenticated, remote attacker   	can exploit these, via a specially crafted request, to   	execute arbitrary script code in a user's browsers   	session. (CVE-2016-9261)

The remote host is running a version of Mac OS X that is 10.11.x prior to 10.11.5. It is, therefore, affected by multiple vulnerabilities in the following components :

  - AMD
  - apache_mod_php
  - AppleGraphicsControl
  - AppleGraphicsPowerManagement
  - Assistant
  - ATS
  - Audio
  - Captive
  - CFNetwork
  - CommonCrypto
  - CoreCapture
  - CoreStorage
  - Crash
  - Disk
  - Disk
  - Driver
  - Drivers
  - Drivers
  - Graphics
  - Graphics
  - Graphics
  - ImageIO
  - Images
  - Intel
  - IOAcceleratorFamily
  - IOAudioFamily
  - IOFireWireFamily
  - IOHIDFamily
  - Kernel
  - libc
  - libxml2
  - libxslt
  - Lock
  - MapKit
  - Messages
  - Multi-Touch
  - Network
  - NVIDIA
  - OpenGL
  - Proxies
  - QuickTime
  - Reporter
  - SceneKit
  - Screen
  - Tcl
  - Utility

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

According to its banner, the version of the remote Apple TV device is prior to 9.2.1. It is, therefore, affected by multiple vulnerabilities in the following components :

  - CFNetwork Proxies
  - CommonCrypto
  - CoreCapture
  - Disk Images
  - ImageIO
  - IOAcceleratorFamily
  - IOHIDFamily
  - Kernel
  - libc
  - libxml2
  - libxslt
  - OpenGL
  - WebKit
  - WebKit Canvas

Note that only 4th generation models are affected by the vulnerabilities.

An update for libxml2 is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

[Updated 18 July 2016] This advisory has been updated to push packages into the Red Hat Enterprise Linux 6 Desktop channels. The packages included in this revised update have not been changed in any way from the packages included in the original advisory.

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es) :

A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an application linked against libxml2, would cause the application to crash or execute arbitrary code with the permissions of the user running the application.
(CVE-2016-1834, CVE-2016-1840)

Multiple denial of service flaws were found in libxml2. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, could cause that application to crash. (CVE-2016-1762, CVE-2016-1833, CVE-2016-1835, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, CVE-2016-3627, CVE-2016-3705, CVE-2016-4447, CVE-2016-4448, CVE-2016-4449)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1292 advisory.

    - Heap-based buffer overread in xmlNextChar (CVE-2016-1762)
    - Bug 763071: Heap-buffer-overflow in xmlStrncat <https://bugzilla.gnome.org/show_bug.cgi?id=763071>     (CVE-2016-1834)
    - Bug 757711: Heap-buffer-overflow in xmlFAParsePosCharGroup     <https://bugzilla.gnome.org/show_bug.cgi?id=757711> (CVE-2016-1840)
    - Bug 758588: Heap-based buffer overread in xmlParserPrintFileContextInternal     <https://bugzilla.gnome.org/show_bug.cgi?id=758588> (CVE-2016-1838)
    - Bug 758605: Heap-based buffer overread in xmlDictAddString     <https://bugzilla.gnome.org/show_bug.cgi?id=758605> (CVE-2016-1839)
    - Bug 759398: Heap use-after-free in xmlDictComputeFastKey     <https://bugzilla.gnome.org/show_bug.cgi?id=759398> (CVE-2016-1836)
    - Fix inappropriate fetch of entities content (CVE-2016-4449)
    - Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral (CVE-2016-1837)
    - Heap use-after-free in xmlSAX2AttributeNs (CVE-2016-1835)
    - Heap-based buffer-underreads due to xmlParseName (CVE-2016-4447)
    - Heap-based buffer overread in htmlCurrentChar (CVE-2016-1833)
    - Add missing increments of recursion depth counter to XML parser. (CVE-2016-3705)
    - Avoid building recursive entities (CVE-2016-3627)
    - Fix some format string warnings with possible format string vulnerability (CVE-2016-4448)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libxml2 fixes the following issues :

  - CVE-2017-9047, CVE-2017-9048: The function     xmlSnprintfElementContent in valid.c was vulnerable to a     stack-based buffer overflow (bsc#1039063, bsc#1039064)

  - CVE-2017-9049: The function xmlDictComputeFastKey in     dict.c was vulnerable to a heap-based buffer over-read.
    (bsc#1039066)

  - CVE-2017-9050: The function xmlDictAddString was     vulnerable to a heap-based buffer over-read     (bsc#1039661)

  - CVE-2016-1839: heap-based buffer overflow     (xmlDictAddString func) (bnc#1039069)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X that is 10.9.5 or 10.10.5 and is missing Security Update 2016-003. It is, therefore, affected by multiple vulnerabilities in the following components :

  - AMD
  - Captive Network Assistant
  - libxml2
  - libxslt
  - OpenGL

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Several vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause a denial of service against the application, or potentially the execution of arbitrary code with the privileges of the user running the application.

For Debian 7 'Wheezy', these problems have been fixed in version 2.8.0+dfsg1-7+wheezy6.

We recommend that you upgrade your libxml2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Update doc/redhat.gif in tarball

  - Add libxml2-oracle-enterprise.patch and update logos in     tarball

  - Heap-based buffer overread in xmlNextChar     (CVE-2016-1762)

  - Bug 763071: Heap-buffer-overflow in xmlStrncat     (CVE-2016-1834)

  - Bug 757711: Heap-buffer-overflow in     xmlFAParsePosCharGroup (CVE-2016-1840)

  - Bug 758588: Heap-based buffer overread in     xmlParserPrintFileContextInternal (CVE-2016-1838)

  - Bug 758605: Heap-based buffer overread in     xmlDictAddString (CVE-2016-1839)

  - Bug 759398: Heap use-after-free in xmlDictComputeFastKey     (CVE-2016-1836)

  - Fix inappropriate fetch of entities content     (CVE-2016-4449)

  - Heap use-after-free in htmlParsePubidLiteral and     htmlParseSystemiteral (CVE-2016-1837)

  - Heap use-after-free in xmlSAX2AttributeNs     (CVE-2016-1835)

  - Heap-based buffer-underreads due to xmlParseName     (CVE-2016-4447)

  - Heap-based buffer overread in htmlCurrentChar     (CVE-2016-1833)

  - Add missing increments of recursion depth counter to XML     parser. (CVE-2016-3705)

  - Avoid building recursive entities (CVE-2016-3627)

  - Fix some format string warnings with possible format     string vulnerability (CVE-2016-4448)

  - More format string warnings with possible format string     vulnerability (CVE-2016-4448)

  - Fix large parse of file from memory (rhbz#862969)

A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an application linked against libxml2, would cause the application to crash or execute arbitrary code with the permissions of the user running the application.
(CVE-2016-1834 , CVE-2016-1840)

Multiple denial of service flaws were found in libxml2. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, could cause that application to crash. (CVE-2016-1762 , CVE-2016-1833 , CVE-2016-1835 , CVE-2016-1836 , CVE-2016-1837 , CVE-2016-1838 , CVE-2016-1839 , CVE-2016-3627 , CVE-2016-3705 , CVE-2016-4447 , CVE-2016-4448 , CVE-2016-4449)

Daniel Veillard reports :

More format string warnings with possible format string vulnerability (David Kilzer)

Avoid building recursive entities (Daniel Veillard)

Heap-based buffer overread in htmlCurrentChar (Pranjal Jumde)

Heap-based buffer-underreads due to xmlParseName (David Kilzer)

Heap use-after-free in xmlSAX2AttributeNs (Pranjal Jumde)

Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral (Pranjal Jumde)

Fix some format string warnings with possible format string vulnerability (David Kilzer)

Detect change of encoding when parsing HTML names (Hugh Davenport)

Fix inappropriate fetch of entities content (Daniel Veillard)

Bug 759398: Heap use-after-free in xmlDictComputeFastKey (Pranjal Jumde)

Bug 758605: Heap-based buffer overread in xmlDictAddString (Pranjal Jumde)

Bug 758588: Heap-based buffer overread in xmlParserPrintFileContextInternal (David Kilzer)

Bug 757711: heap-buffer-overflow in xmlFAParsePosCharGroup (Pranjal Jumde)

Add missing increments of recursion depth counter to XML parser.
(Peter Simons)

Fix NULL pointer deref in XPointer range-to

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
91656	SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2016:1538-1)	Nessus	SuSE Local Security Checks	2016/6/17	2021/1/6	critical
93154	SUSE SLES11 Security Update : libxml2 (SUSE-SU-2016:1604-1)	Nessus	SuSE Local Security Checks	2016/8/29	2026/1/28	critical
97893	Tenable Log Correlation Engine (LCE) < 4.8.1 Multiple Vulnerabilities	Nessus	Misc.	2017/3/22	2025/12/29	critical
91228	Mac OS X 10.11.x < 10.11.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2016/5/19	2024/5/28	high
91311	Apple TV < 9.2.1 Multiple Vulnerabilities	Nessus	Misc.	2016/5/24	2019/11/14	high
91786	CentOS 6 / 7 : libxml2 (CESA-2016:1292)	Nessus	CentOS Local Security Checks	2016/6/24	2021/1/4	critical
91797	Oracle Linux 6 / 7 : libxml2 (ELSA-2016-1292)	Nessus	Oracle Linux Local Security Checks	2016/6/24	2024/11/1	critical
100544	SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2017:1454-1)	Nessus	SuSE Local Security Checks	2017/5/31	2025/12/17	high
91229	Mac OS X 10.9.5 / 10.10.5 Multiple Vulnerabilities (Security Update 2016-003)	Nessus	MacOS X Local Security Checks	2016/5/19	2024/5/28	high
91472	Debian DLA-503-1 : libxml2 security update	Nessus	Debian Local Security Checks	2016/6/6	2021/1/11	high
91800	OracleVM 3.3 / 3.4 : libxml2 (OVMSA-2016-0087)	Nessus	OracleVM Local Security Checks	2016/6/24	2021/1/4	critical
92221	Amazon Linux AMI : libxml2 (ALAS-2016-719)	Nessus	Amazon Linux Local Security Checks	2016/7/15	2026/2/2	critical
93145	FreeBSD : libxml2 -- multiple vulnerabilities (e195679d-045b-4953-bb33-be0073ba2ac6)	Nessus	FreeBSD Local Security Checks	2016/8/29	2026/1/28	high
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	2023/6/30	2023/7/6	critical

检测

插件搜索

critical

critical

critical

high

high

critical

critical

high

high

high

critical

critical

high

critical