Security fix for CVE-2017-15412 CVE-2017-15422 CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411 CVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15423 CVE-2017-15424 CVE-2017-15425 CVE-2017-15426 CVE-2017-15427 CVE-2017-15429

----

Security fix for CVE-2017-15398, CVE-2017-15399

----

Security fix for CVE-2017-15386 CVE-2017-15387 CVE-2017-15388 CVE-2017-15389 CVE-2017-15390 CVE-2017-15391 CVE-2017-15392 CVE-2017-15393 CVE-2017-15394 CVE-2017-15395 CVE-2017-5124 CVE-2017-5125 CVE-2017-5126 CVE-2017-5127.

Build switched to use gtk3.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libxml2 fixes three security issues :

  - CVE-2017-15412: Prevent use after free when calling     XPath extension functions that allowed remote attackers     to cause DoS or potentially RCE (bsc#1077993)

  - CVE-2016-5131: Use-after-free vulnerability in libxml2     allowed remote attackers to cause a denial of service or     possibly have unspecified other impact via vectors     related to the XPointer range-to function. (bsc#1078813)

  - CVE-2017-5130: Fixed a potential remote buffer overflow     in function xmlMemoryStrdup() (bsc#1078806)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

The remote host is running Mac OS X 10.11.6 or Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities affecting the following components :

  - ATS
  - CFNetwork Session
  - CoreFoundation
  - CoreTypes
  - curl
  - Disk Images
  - iCloud Drive
  - Kernel
  - kext tools
  - LaunchServices
  - PluginKit
  - Security
  - Storage
  - Terminal

According to the version of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Use after free in libxml2 before 2.9.5, as used in     Google Chrome prior to 63.0.3239.84 and other products,     allowed a remote attacker to potentially exploit heap     corruption via a crafted HTML page.(CVE-2018-15412)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - Use after free in libxml2 before 2.9.5, as used in     Google Chrome prior to 63.0.3239.84 and other products,     allowed a remote attacker to potentially exploit heap     corruption via a crafted HTML page.i1/4^CVE-2017-15412i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1190 advisory.

  - The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which     allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.
    (CVE-2015-8035)

  - Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82,     allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors     related to the XPointer range-to function. (CVE-2016-5131)

  - Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products,     allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2017-15412)

  - The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of     service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict     memory usage to what is required for a legitimate file. (CVE-2017-18258)

  - A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2     through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case.
    Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable     to a denial of service attack due to a crash of the application. (CVE-2018-14404)

  - libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite     loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different     vulnerability than CVE-2015-8035 and CVE-2018-9251. (CVE-2018-14567)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libxml2 packages installed that are affected by multiple vulnerabilities:

  - Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82,     allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors     related to the XPointer range-to function. (CVE-2016-5131)

  - Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products,     allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2017-15412)

  - A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2     through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case.
    Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable     to a denial of service attack due to a crash of the application. (CVE-2018-14404)

  - libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite     loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different     vulnerability than CVE-2015-8035 and CVE-2018-9251. (CVE-2018-14567)

  - The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of     service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict     memory usage to what is required for a legitimate file. (CVE-2017-18258)

  - The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which     allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.
    (CVE-2015-8035)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.17.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.17.1 advisory.

  - When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to     Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP     connection. If such connections are available to an attacker, they can be exploited in ways that may be     surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped     with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected     (and recommended in the security guide) that this Connector would be disabled if not required. This     vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the     web application - processing any file in the web application as a JSP Further, if the web application     allowed file upload and stored those files within the web application (or the attacker was able to control     the content of the web application by some other means) then this, along with the ability to process a     file as a JSP, made remote code execution possible. It is important to note that mitigation is only     required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth     approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to     Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP     Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading     to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
    (CVE-2020-1938)

  - rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a     certain upper-bound check, leading to a buffer overflow. (CVE-2019-17666)

  - The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-     free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can     occur with FUSE requests. (CVE-2019-11487)

  - A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where,     the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error     occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by     the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction     mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism     to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that     host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.
    (CVE-2019-19338)

  - The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which     allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.
    (CVE-2015-8035)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products,     allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2017-15412)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-016:01 advisory.

    * libxml2: Use after free triggered by XPointer paths beginning with range-to (CVE-2016-5131)
      * libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate() function in xpath.c     (CVE-2017-15412)
      * libxml2: DoS caused by incorrect error detection during XZ decompression (CVE-2015-8035)
      * libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c (CVE-2018-14404)
      * libxml2: Unrestricted memory usage in xz_head() function in xzlib.c (CVE-2017-18258)
      * libxml2: Infinite loop caused by incorrect error detection during LZMA decompression (CVE-2018-14567)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iOS running on the mobile device is prior to 11.3. It is, therefore, affected by multiple vulnerabilities.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1190 advisory.

    - Fix CVE-2015-8035 (#1595697)
    - Fix CVE-2018-14404 (#1602817)
    - Fix CVE-2017-15412 (#1729857)
    - Fix CVE-2016-5131 (#1714050)
    - Fix CVE-2017-18258 (#1579211)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 27 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2018-faff5f661e advisory.

    Update to Chromium 65. For EPEL7, it has been a long time since a successful build has been possible, so     this will fix a LOT of CVEs.

    CVE-2017-15396     CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411 CVE-2017-15412 CVE-2017-15413     CVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15422     CVE-2018-6056 CVE-2018-6406     CVE-2018-6057 CVE-2018-6058 CVE-2018-6059 CVE-2018-6060 CVE-2018-6061 CVE-2018-6062 CVE-2018-6063     CVE-2018-6064 CVE-2018-6065 CVE-2018-6066 CVE-2018-6067 CVE-2018-6068 CVE-2018-6069 CVE-2018-6070     CVE-2018-6071

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
105501	Fedora 26 : chromium (2017-ea44f172e3)	Nessus	Fedora Local Security Checks	2018/1/2	2025/11/10	critical
106741	openSUSE Security Update : libxml2 (openSUSE-2018-154)	Nessus	SuSE Local Security Checks	2018/2/12	2025/10/29	high
108787	macOS and Mac OS X Multiple Vulnerabilities (Security Update 2018-002)	Nessus	MacOS X Local Security Checks	2018/4/2	2024/11/21	critical
119935	EulerOS 2.0 SP2 : libxml2 (EulerOS-SA-2018-1446)	Nessus	Huawei Local Security Checks	2018/12/28	2024/7/12	high
123897	EulerOS Virtualization 2.5.4 : libxml2 (EulerOS-SA-2019-1211)	Nessus	Huawei Local Security Checks	2019/4/9	2024/6/4	high
135358	CentOS 7 : libxml2 (RHSA-2020:1190)	Nessus	CentOS Local Security Checks	2020/4/10	2024/10/9	high
143906	NewStart CGSL CORE 5.04 / MAIN 5.04 : libxml2 Multiple Vulnerabilities (NS-SA-2020-0060)	Nessus	NewStart CGSL Local Security Checks	2020/12/9	2024/2/5	high
164612	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.17.1)	Nessus	Misc.	2022/9/1	2025/9/1	critical
220695	Linux Distros Unpatched Vulnerability : CVE-2017-15412	Nessus	Misc.	2025/3/4	2025/8/21	high
291688	MiracleLinux 7 : libxml2-2.9.1-6.4.0.1.el7.AXS7 (AXSA:2020-016:01)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	high
108812	Apple iOS < 11.3 Multiple Vulnerabilities	Nessus	Mobile Devices	2018/4/3	2026/3/23	critical
180731	Oracle Linux 7 : libxml2 (ELSA-2020-1190)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	high
108679	Fedora 27 : chromium (2018-faff5f661e)	Nessus	Fedora Local Security Checks	2018/3/28	2025/9/1	high

检测

插件搜索

critical

high

critical

high

high

high

high

critical

high

high

critical

high

high