The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14729-1 advisory.

  - The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in     Oracle HTTP Server in Oracle Fusion Middleware 11.1.1.7.0, 12.1.2.0, and 12.1.3.0 and other products,     loads external parameter entities regardless of whether entity substitution or validation is enabled,     which allows remote attackers to cause a denial of service (resource consumption) via a crafted XML     document. (CVE-2014-0191)

  - xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to     newDoc->oldNs. (CVE-2019-19956)

  - xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
    (CVE-2019-20388)

  - GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at     libxml2/entities.c. The issue has been fixed in commit 50f06b3e. (CVE-2020-24977)

  - xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file     situation. (CVE-2020-7595)

  - There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted     file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to     confidentiality, integrity, and availability. (CVE-2021-3516)

  - There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker     who is able to supply a crafted file to be processed by an application linked with the affected     functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to     application availability, with some potential impact to confidentiality and integrity if an attacker is     able to use memory information to further exploit the application. (CVE-2021-3517)

  - There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to     be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact     from this flaw is to confidentiality, integrity, and availability. (CVE-2021-3518)

  - A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while     parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery     mode and post-validated, the flaw could be used to crash the application. The highest threat from this     vulnerability is to system availability. (CVE-2021-3537)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libxml2 packages installed that are affected by multiple vulnerabilities:

  - xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to     newDoc->oldNs. (CVE-2019-19956)

  - xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
    (CVE-2019-20388)

  - xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file     situation. (CVE-2020-7595)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3996 advisory.

    - Fix CVE-2019-19956 (#1793000)
    - Fix CVE-2019-20388 (#1810057)
    - Fix CVE-2020-7595 (#1810073)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the libxml2 package has been released.

The version of AOS installed on the remote host is prior to 5.19.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.19.0.5 advisory.

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. (CVE-2019-5482)

  - In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives.
    When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may     contain files with permissions the attacker did not have or in paths he did not have access to. Extracting     those archives from a high-privilege user without carefully reviewing them may lead to the compromise of     the system. (CVE-2019-14866)

  - If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to     8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the     HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP     headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This     could lead to users seeing responses for unexpected resources. (CVE-2020-13943)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.15.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.15.5 advisory.

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. (CVE-2019-5482)

  - In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives.
    When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may     contain files with permissions the attacker did not have or in paths he did not have access to. Extracting     those archives from a high-privilege user without carefully reviewing them may lead to the compromise of     the system. (CVE-2019-14866)

  - If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to     8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the     HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP     headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This     could lead to users seeing responses for unexpected resources. (CVE-2020-13943)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libxml2 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - This library allows to manipulate XML files. It     includes support to read, modify and write XML and HTML     files. There is DTDs support this includes parsing and     validation even with complex DtDs, either at parse time     or later once the document has been modified. The     output can be a simple SAX stream or and in-memory DOM     like representations. In this case one can use the     built-in XPath and XPointer implementation to select     sub nodes or ranges. A flexible Input/Output mechanism     is available, with existing HTTP and FTP modules and     combined to an URI library. Security     Fix(es):xmlParseBalancedChunkMemoryRecover in parser.c     in libxml2 before 2.9.10 has a memory leak related to     newDoc->oldNs.(CVE-2019-19956)xmlStringLenDecodeEntitie     s in parser.c in libxml2 2.9.10 has an infinite loop in     a certain end-of-file situation.(CVE-2020-7595)A memory     leak was found in the xmlSchemaValidateStream function     of libxml2. Applications that use this library may be     vulnerable to memory not being freed leading to a     denial of service. System availability is the highest     threat from this vulnerability.(CVE-2019-20388)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libxml2 fixes the following issues :

CVE-2019-20388: Fixed a memory leak in xmlSchemaPreRun (bsc#1161521).

CVE-2019-19956: Fixed a memory leak (bsc#1159928).

CVE-2020-7595: Fixed an infinite loop in an EOF situation (bsc#1161517).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libxml2 fixes the following issues :

  - CVE-2019-20388: Fixed a memory leak in xmlSchemaPreRun     (bsc#1161521).

  - CVE-2019-19956: Fixed a memory leak (bsc#1159928).

  - CVE-2020-7595: Fixed an infinite loop in an EOF     situation (bsc#1161517).

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3996 advisory.

    The libxml2 library is a development toolbox providing the implementation of various XML standards.

    Security Fix(es):

    * libxml2: memory leak in xmlParseBalancedChunkMemoryRecover in parser.c (CVE-2019-19956)

    * libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c (CVE-2019-20388)

    * libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations (CVE-2020-7595)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1534 advisory.

    xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to     newDoc->oldNs. (CVE-2019-19956)

    A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this     library may be vulnerable to memory not being freed leading to a denial of service. System availability is     the highest threat from this vulnerability. (CVE-2019-20388)

    xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file     situation. (CVE-2020-7595)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has libxml2 packages installed that are affected by multiple vulnerabilities:

  - xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file     situation. (CVE-2020-7595)

  - xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to     newDoc->oldNs. (CVE-2019-19956)

  - xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
    (CVE-2019-20388)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4991-1 advisory.

    Yunho Kim discovered that libxml2 incorrectly handled certain error conditions. A remote attacker could     exploit this with a crafted XML file to cause a denial of service, or possibly cause libxml2 to expose     sensitive information. This issue only affected Ubuntu 14.04 ESM, and Ubuntu 16.04 ESM. (CVE-2017-8872)

    Zhipeng Xie discovered that libxml2 incorrectly handled certain XML schemas. A remote attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 ESM, Ubuntu     16.04 ESM, and Ubuntu 18.04 LTS. (CVE-2019-20388)

    It was discovered that libxml2 incorrectly handled invalid UTF-8 input. A remote attacker could possibly     exploit this with a crafted XML file to cause libxml2 to crash, resulting in a denial of service. This     issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu     20.10. (CVE-2020-24977)

    It was discovered that libxml2 incorrectly handled invalid UTF-8 input. A remote attacker could possibly     exploit this with a crafted XML file to cause libxml2 to crash, resulting in a denial of service.
    (CVE-2021-3517)

    It was discovered that libxml2 did not properly handle certain crafted XML files. A local attacker could     exploit this with a crafted input to cause libxml2 to crash, resulting in a denial of service, or possibly     execute arbitrary code. (CVE-2021-3516, CVE-2021-3518)

    It was discovered that libxml2 incorrectly handled error states. A remote attacker could exploit this with     a crafted XML file to cause libxml2 to crash, resulting in a denial of service. (CVE-2021-3537)

    Sebastian Pipping discovered that libxml2 did not properly handle certain crafted XML files. A remote     attacker could exploit this with a crafted XML file to cause libxml2 to crash, resulting in a denial of     service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-3541)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

The version of AOS installed on the remote host is prior to 5.19.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.19.1 advisory.

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. (CVE-2019-5482)

  - In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives.
    When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may     contain files with permissions the attacker did not have or in paths he did not have access to. Extracting     those archives from a high-privilege user without carefully reviewing them may lead to the compromise of     the system. (CVE-2019-14866)

  - If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to     8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the     HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP     headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This     could lead to users seeing responses for unexpected resources. (CVE-2020-13943)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
150579	SUSE SLES11 Security Update : libxml2 (SUSE-SU-2021:14729-1)	Nessus	SuSE Local Security Checks	2021/6/10	2023/12/26	high
154604	NewStart CGSL CORE 5.05 / MAIN 5.05 : libxml2 Multiple Vulnerabilities (NS-SA-2021-0148)	Nessus	NewStart CGSL Local Security Checks	2021/10/28	2021/10/28	high
180992	Oracle Linux 7 : libxml2 (ELSA-2020-3996)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	high
203132	Photon OS 3.0: Libxml2 PHSA-2020-3.0-0067	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/24	high
164556	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.0.5)	Nessus	Misc.	2022/9/1	2025/7/22	critical
164599	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.5)	Nessus	Misc.	2022/9/1	2025/7/22	critical
135304	Photon OS 2.0: Libxml2 PHSA-2020-2.0-0225	Nessus	PhotonOS Local Security Checks	2020/4/10	2024/7/23	high
136236	EulerOS Virtualization for ARM 64 3.0.2.0 : libxml2 (EulerOS-SA-2020-1533)	Nessus	Huawei Local Security Checks	2020/5/1	2024/3/13	high
136792	SUSE SLED15 / SLES15 Security Update : libxml2 (SUSE-SU-2020:1299-1)	Nessus	SuSE Local Security Checks	2020/5/22	2024/3/12	high
136879	openSUSE Security Update : libxml2 (openSUSE-2020-681)	Nessus	SuSE Local Security Checks	2020/5/26	2024/3/8	high
141039	RHEL 7 : libxml2 (RHSA-2020:3996)	Nessus	Red Hat Local Security Checks	2020/9/29	2024/11/7	high
141978	Amazon Linux 2 : libxml2 (ALAS-2020-1534)	Nessus	Amazon Linux Local Security Checks	2020/10/28	2024/12/11	high
147266	NewStart CGSL MAIN 6.02 : libxml2 Multiple Vulnerabilities (NS-SA-2021-0061)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2021/3/10	high
150858	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS : libxml2 vulnerabilities (USN-4991-1)	Nessus	Ubuntu Local Security Checks	2021/6/17	2025/9/3	critical
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	2023/6/30	2023/7/6	critical
164584	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.1)	Nessus	Misc.	2022/9/1	2025/7/22	critical

检测

插件搜索

high

high

high

high

critical

critical

high

high

high

high

high

high

high

critical

critical

critical