The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-545:01 advisory.

    This library allows to manipulate XML files. It includes support     to read, modify and write XML and HTML files. There is DTDs support     this includes parsing and validation even with complex DtDs, either     at parse time or later once the document has been modified. The output     can be a simple SAX stream or and in-memory DOM like representations.
    In this case one can use the built-in XPath and XPointer implementation     to select sub nodes or ranges. A flexible Input/Output mechanism is     available, with existing HTTP and FTP modules and combined to an     URI library.
    Security issues fixed with this release:
    CVE-2016-1762     libxml2 in Apple iOS before 9.3, OS X before 10.11.4, Safari before     9.1, tvOS before 9.2, and watchOS before 2.2 allows remote attackers     to execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document.
    CVE-2016-1833     libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS     before 9.2.1, and watchOS before 2.2.1, allows remote attackers to     execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document, a different vulnerability than     CVE-2016-1834, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838,     CVE-2016-1839, and CVE-2016-1840.
    CVE-2016-1834     libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS     before 9.2.1, and watchOS before 2.2.1, allows remote attackers to     execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document, a different vulnerability than     CVE-2016-1833, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838,     CVE-2016-1839, and CVE-2016-1840.
    CVE-2016-1835     libxml2, as used in Apple iOS before 9.3.2 and OS X before 10.11.5,     allows remote attackers to execute arbitrary code or cause a denial of     service (memory corruption) via a crafted XML document.
    CVE-2016-1836     libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS     before 9.2.1, and watchOS before 2.2.1, allows remote attackers to     execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document, a different vulnerability than     CVE-2016-1833, CVE-2016-1834, CVE-2016-1837, CVE-2016-1838,     CVE-2016-1839, and CVE-2016-1840.
    CVE-2016-1837     libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS     before 9.2.1, and watchOS before 2.2.1, allows remote attackers to     execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document, a different vulnerability than     CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1838,     CVE-2016-1839, and CVE-2016-1840.
    CVE-2016-1838     libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS     before 9.2.1, and watchOS before 2.2.1, allows remote attackers to     execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document, a different vulnerability than     CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1837,     CVE-2016-1839, and CVE-2016-1840.
    CVE-2016-1839     libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS     before 9.2.1, and watchOS before 2.2.1, allows remote attackers to     execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document, a different vulnerability than     CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1837,     CVE-2016-1838, and CVE-2016-1840.
    CVE-2016-1840     libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS     before 9.2.1, and watchOS before 2.2.1, allows remote attackers to     execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document, a different vulnerability than     CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1837,     CVE-2016-1838, and CVE-2016-1839.
    CVE-2016-3627     The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and     earlier, when used in recovery mode, allows context-dependent     attackers to cause a denial of service (infinite recursion, stack     consumption, and application crash) via a crafted XML document.
    CVE-2016-3705     The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions     in parser.c in libxml2 2.9.3 do not properly keep track of the     recursion depth, which allows context-dependent attackers to cause a     denial of service (stack consumption and application crash) via a     crafted XML document containing a large number of nested entity     references.
    CVE-2016-4447     The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4     allows context-dependent attackers to cause a denial of service     (heap-based buffer underread and application crash) via a crafted     file, involving xmlParseName.
    CVE-2016-4448     Format string vulnerability in libxml2 before 2.9.4 allows attackers     to have unspecified impact via format string specifiers in unknown     vectors.
    CVE-2016-4449     XML external entity (XXE) vulnerability in the     xmlStringLenDecodeEntities function in parser.c in libxml2 before     2.9.4, when not in validating mode, allows context-dependent attackers     to read arbitrary files or cause a denial of service (resource     consumption) via unspecified vectors.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to latest upstream release, includes several security related fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-37 (libxml2: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libxml2. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user or automated system to process a       specially crafted XML document, possibly resulting in execution of       arbitrary code with the privileges of the process or a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

The mobile device is running a version of iOS prior to 9.3.2. It is, therefore, affected by multiple vulnerabilities in the following components :

  - Accessibility
  - CFNetwork Proxies
  - CommonCrypto
  - CoreCapture
  - Disk Images
  - ImageIO
  - IOAcceleratorFamily
  - IOHIDFamily
  - Kernel
  - libc
  - libxml2
  - libxslt
  - MapKit
  - OpenGL
  - Safari
  - Siri
  - WebKit
  - WebKit Canvas

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
289699	MiracleLinux 7 : libxml2-2.9.1-6.0.1.el7.AXS7.3 (AXSA:2016-545:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
99491	Fedora 25 : libxml2 (2017-a3a47973eb)	Nessus	Fedora Local Security Checks	2017/4/20	2025/12/25	critical
99492	Fedora 24 : libxml2 (2017-be8574d593)	Nessus	Fedora Local Security Checks	2017/4/20	2025/12/25	critical
96541	GLSA-201701-37 : libxml2: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/1/17	2026/1/5	critical
91225	Apple iOS < 9.3.2 Multiple Vulnerabilities	Nessus	Mobile Devices	2016/5/18	2026/8/10	high

检测

插件搜索

critical

critical

critical

critical

high