An update for libxml2 is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

[Updated 18 July 2016] This advisory has been updated to push packages into the Red Hat Enterprise Linux 6 Desktop channels. The packages included in this revised update have not been changed in any way from the packages included in the original advisory.

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es) :

A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an application linked against libxml2, would cause the application to crash or execute arbitrary code with the permissions of the user running the application.
(CVE-2016-1834, CVE-2016-1840)

Multiple denial of service flaws were found in libxml2. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, could cause that application to crash. (CVE-2016-1762, CVE-2016-1833, CVE-2016-1835, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, CVE-2016-3627, CVE-2016-3705, CVE-2016-4447, CVE-2016-4448, CVE-2016-4449)

Security Fix(es) :

A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an application linked against libxml2, would cause the application to crash or execute arbitrary code with the permissions of the user running the application.
(CVE-2016-1834, CVE-2016-1840)

Multiple denial of service flaws were found in libxml2. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, could cause that application to crash. (CVE-2016-1762, CVE-2016-1833, CVE-2016-1835, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, CVE-2016-3627, CVE-2016-3705, CVE-2016-4447, CVE-2016-4448, CVE-2016-4449)

The version of Apple iTunes running on the remote Windows host is prior to 12.4.2. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist in the libxslt     component due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     execution of arbitrary code. (CVE-2016-1684,     CVE-2016-4607, CVE-2016-4608, CVE-2016-4609,     CVE-2016-4610, CVE-2016-4612)

  - Multiple memory corruption issues exist in the libxml2     component that allow a remote attacker to cause a denial     of service condition or the execution of arbitrary code.
    (CVE-2016-1836, CVE-2016-4447, CVE-2016-4448,     CVE-2016-4483, CVE-2016-4614, CVE-2016-4615,     CVE-2016-4616, CVE-2016-4619)

  - An XXE (Xml eXternal Entity) injection vulnerability     exists in the libxml2 component due to an incorrectly     configured XML parser accepting XML external entities     from an untrusted source. A remote attacker can exploit     this, via a specially crafted XML file, to disclose     arbitrary files and user information. (CVE-2016-4449)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to latest upstream release, includes several security related fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of the remote Apple TV device is prior to 9.2.2. It is, therefore, affected by multiple vulnerabilities in the following components :

  - CoreGraphics
  - ImageIO
  - IOAcceleratorFamily
  - IOHIDFamily
  - Kernel
  - libxml2
  - libxslt
  - Sandbox Profiles
  - WebKit
  - WebKit Page Loading

Note that only 4th generation models are affected by the vulnerabilities.

The version of iOS running on the mobile device is prior to 9.3.3. It is, therefore, affected by multiple vulnerabilities, the most serious of which can result in remote code execution, in the following components :

  - Calendar
  - CoreGraphics
  - FaceTime
  - ImageIO
  - IOAcceleratorFamily
  - IOHIDFamily
  - Kernel
  - libxml2
  - libxslt
  - Safari
  - Sandbox Profiles
  - Siri Contacts
  - Web Media
  - WebKit
  - WebKit JavaScript Bindings
  - WebKit Page Loading

The remote host is running a version of Mac OS X that is 10.11.x prior to 10.11.6. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache_mod_php
  - Audio
  - bsdiff
  - CFNetwork
  - CoreGraphics
  - FaceTime
  - Graphics Drivers
  - ImageIO
  - Intel Graphics Driver
  - IOHIDFamily
  - IOKit
  - IOSurface
  - Kernel
  - libc++abi
  - libexpat
  - LibreSSL
  - libxml2
  - libxslt
  - Login Window
  - OpenSSL
  - QuickTime
  - Safari Login AutoFill
  - Sandbox Profiles

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
91802	RHEL 6 / 7 : libxml2 (RHSA-2016:1292)	Nessus	Red Hat Local Security Checks	2016/6/24	2020/4/8	critical
91808	Scientific Linux Security Update : libxml2 on SL6.x, SL7.x i386/x86_64 (20160623)	Nessus	Scientific Linux Local Security Checks	2016/6/24	2021/1/14	critical
92411	Apple iTunes < 12.4.2 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	2016/7/19	2026/1/30	critical
99491	Fedora 25 : libxml2 (2017-a3a47973eb)	Nessus	Fedora Local Security Checks	2017/4/20	2025/12/25	critical
99492	Fedora 24 : libxml2 (2017-be8574d593)	Nessus	Fedora Local Security Checks	2017/4/20	2025/12/25	critical
92494	Apple TV < 9.2.2 Multiple Vulnerabilities	Nessus	Misc.	2016/7/21	2026/1/30	critical
92359	Apple iOS < 9.3.3 Multiple Vulnerabilities	Nessus	Mobile Devices	2016/7/19	2026/3/23	critical
92496	Mac OS X 10.11.x < 10.11.6 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2016/7/21	2024/5/28	critical
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	2023/6/30	2023/7/6	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical