According to the version of the libxml2 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - GNOME project libxml2 v2.9.10 has a global buffer     over-read vulnerability in xmlEncodeEntitiesInternal at     libxml2/entities.c. The issue has been fixed in commit     50f06b3e.(CVE-2020-24977)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - GNOME project libxml2 v2.9.10 and earlier have a global     Buffer Overflow vulnerability in     xmlEncodeEntitiesInternal at libxml2/entities.c. The     issue has been fixed in commit 8e7c20a1     (20910-GITv2.9.10-103-g8e7c20a1).(CVE-2020-24977)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-1597 advisory.

    [2.9.7-9.0.1]
    - Update doc/redhat.gif in tarball
    - Add libxml2-oracle-enterprise.patch and update logos in tarball

    [2.9.7-9]
    - Fix CVE-2020-24977 (#1878252)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14729-1 advisory.

  - The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in     Oracle HTTP Server in Oracle Fusion Middleware 11.1.1.7.0, 12.1.2.0, and 12.1.3.0 and other products,     loads external parameter entities regardless of whether entity substitution or validation is enabled,     which allows remote attackers to cause a denial of service (resource consumption) via a crafted XML     document. (CVE-2014-0191)

  - xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to     newDoc->oldNs. (CVE-2019-19956)

  - xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
    (CVE-2019-20388)

  - GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at     libxml2/entities.c. The issue has been fixed in commit 50f06b3e. (CVE-2020-24977)

  - xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file     situation. (CVE-2020-7595)

  - There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted     file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to     confidentiality, integrity, and availability. (CVE-2021-3516)

  - There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker     who is able to supply a crafted file to be processed by an application linked with the affected     functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to     application availability, with some potential impact to confidentiality and integrity if an attacker is     able to use memory information to further exploit the application. (CVE-2021-3517)

  - There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to     be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact     from this flaw is to confidentiality, integrity, and availability. (CVE-2021-3518)

  - A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while     parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery     mode and post-validated, the flaw could be used to crash the application. The highest threat from this     vulnerability is to system availability. (CVE-2021-3537)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-1786:01 advisory.

    * libxml2: Buffer overflow vulnerability in xmlEncodeEntitiesInternal() in entities.c (CVE-2020-24977)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
147071	EulerOS Virtualization for ARM 64 3.0.6.0 : libxml2 (EulerOS-SA-2021-1553)	Nessus	Huawei Local Security Checks	2021/3/4	2024/1/16	medium
147671	EulerOS Virtualization 2.9.0 : libxml2 (EulerOS-SA-2021-1661)	Nessus	Huawei Local Security Checks	2021/3/11	2024/1/10	medium
149943	Oracle Linux 8 : libxml2 (ELSA-2021-1597)	Nessus	Oracle Linux Local Security Checks	2021/5/26	2024/11/1	medium
150579	SUSE SLES11 Security Update : libxml2 (SUSE-SU-2021:14729-1)	Nessus	SuSE Local Security Checks	2021/6/10	2023/12/26	high
294471	MiracleLinux 8 : libxml2-2.9.7-9.el8 (AXSA:2021-1786:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium

检测

插件搜索

medium

medium

medium

high

medium