The remote host is running a version of macOS / Mac OS X that is 14.x prior to 14.7.5. It is, therefore, affected by multiple vulnerabilities:

  - A use after free issue was addressed with improved memory management. This issue is fixed in visionOS 2.3,     iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. A malicious application may be able     to elevate privileges. Apple is aware of a report that this issue may have been actively exploited against     versions of iOS before iOS 17.2. (CVE-2025-24085)

  - The issue was addressed with improved handling of protocols. This issue is fixed in macOS Ventura 13.7.5,     macOS Sonoma 14.7.5. An attacker in a privileged network position can track a user's activity.
    (CVE-2024-40864)

  - A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS     Ventura 13.7.5, macOS Sonoma 14.7.5. An app may be able to access sensitive user data. (CVE-2024-54533)

  - libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and     xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated     against an XML schema with certain identity constraints, or a crafted XML schema must be used.
    (CVE-2024-56171)

  - When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache     entry, making it end sooner or later than otherwise intended. This affects curl using applications that     enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like     `x.example.com` as well as `example.com` where the first host is a subdomain of the second host. (The HSTS     cache either needs to have been populated manually or there needs to have been previous HTTPS accesses     done as the cache needs to have entries for the domains involved to trigger this problem.) When     `x.example.com` responds with `Strict-Transport-Security:` headers, this bug can make the subdomain's     expiry timeout *bleed over* and get set for the parent domain `example.com` in curl's HSTS cache. The     result of a triggered bug is that HTTP accesses to `example.com` get converted to HTTPS for a different     period of time than what was asked for by the origin server. If `example.com` for example stops supporting     HTTPS at its expiry time, curl might then fail to access `http://example.com` until the (wrongly set)     timeout expires. This bug can also expire the parent's entry *earlier*, thus making curl inadvertently     switch back to insecure HTTP earlier than otherwise intended. (CVE-2024-9681)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

The version of libxml2 installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-27113 advisory.

  - libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in     pattern.c. (CVE-2025-27113)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0746-1 advisory.

    - CVE-2024-56171: use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in     xmlschemas.c       (bsc#1237363).
    - CVE-2025-24928: stack-based buffer overflow in xmlSnprintfElements in valid.c (bsc#1237370).
    - CVE-2025-27113: NULL pointer dereference in xmlPatMatch in pattern.c (bsc#1237418).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0748-1 advisory.

    - CVE-2024-56171: use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in     xmlschemas.c       (bsc#1237363).
    - CVE-2025-24928: stack-based buffer overflow in xmlSnprintfElements in valid.c (bsc#1237370).
    - CVE-2025-27113: NULL pointer dereference in xmlPatMatch in pattern.c (bsc#1237418).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the libxml2 package has been released.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-896 advisory.

    libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and     xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated     against an XML schema with certain identity constraints, or a crafted XML schema must be used.
    (CVE-2024-56171)

    libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements     in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE:
    this is similar to CVE-2017-9047. (CVE-2025-24928)

    libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in     pattern.c. (CVE-2025-27113)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ54754. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ54754 advisory.

  - A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function     xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a     char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is     XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits)     whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name     actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write     about size many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2,     such as PHP, to crash. (CVE-2017-9047)

  - libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements     in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE:
    this is similar to CVE-2017-9047. (CVE-2025-24928)

  - libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in     pattern.c. (CVE-2025-27113)

  - libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and     xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated     against an XML schema with certain identity constraints, or a crafted XML schema must be used.
    (CVE-2024-56171)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0209 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-27113:
    libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in     pattern.c.

    CVE-2025-24928:
    libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements     in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE:
    this is similar to CVE-2017-9047.

    CVE-2024-56171:
    libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and     xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated     against an XML schema with certain identity constraints, or a crafted XML schema must be used.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-9781:05 advisory.

    CVE-2025-27113: fix compilation of explicit child axis     CVE(s):
    CVE-2025-27113     libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in     pattern.c.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in     pattern.c.(CVE-2025-27113)

    libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements     in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE:
    this is similar to CVE-2017-9047.(CVE-2025-24928)

    libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and     xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated     against an XML schema with certain identity constraints, or a crafted XML schema must be     used.(CVE-2024-56171)

    In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API     (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and     xmlPythonFileReadRaw because of a difference between bytes and characters.(CVE-2025-32414)

    In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-     based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema     with certain identity constraints, or a crafted XML schema must be used.(CVE-2025-32415)

    A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under     certain circumstances when the XML schematron has the sch:name path='...'/ schema elements. This     flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the     program's crash using libxml or other possible undefined behaviors.(CVE-2025-49794)

    A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can     trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that     can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to     sensitive data being corrupted in memory.(CVE-2025-49796)

    A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files.
    When a user inputs an overly long command, the program does not check the input size properly, which can     cause it to crash. This issue might allow attackers to run harmful code in rare configurations without     modern protections.(CVE-2025-6170)

    A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations     can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of     service when processing crafted input.(CVE-2025-6021)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libxml2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5949 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5949-1                   security@debian.org     https://www.debian.org/security/                                  Aron Xu     June 26, 2025                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : libxml2     CVE ID         : CVE-2022-49043 CVE-2023-39615 CVE-2023-45322 CVE-2024-25062                      CVE-2024-34459 CVE-2024-56171 CVE-2025-24928 CVE-2025-27113                      CVE-2025-32414 CVE-2025-32415     Debian Bug     : 1051230 1053629 1063234 1071162 1094238 1098320 1098321 1098322 1102521 1103511

    Brief introduction


    Multiple memory related vulnerabilities, inlcuding use-after-free,     out-of-bounds memory access and NULL pointer dereference, were discovered in     GNOME XML Parser and Toolkit Library and its Python bindings, which may cause     denial of service or other unintended behaviors.

    For the stable distribution (bookworm), these problems have been fixed in     version 2.9.14+dfsg-1.3~deb12u2.

    We recommend that you upgrade your libxml2 packages.

    For the detailed security status of libxml2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libxml2

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Java installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2025 CPU advisory.

  - Vulnerability in Oracle Java SE (component: JavaFX (libxml2)). Supported versions that are affected are     Oracle Java SE: 8u451-b50. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     takeover of Oracle Java SE. (CVE-2024-40896)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451,     8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle     GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle     Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. (CVE-2025-30749)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE:     8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle     GraalVM Enterprise Edition: 21.3.14. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change).     Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.     (CVE-2025-50059)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
233570	macOS 14.x < 14.7.5 Multiple Vulnerabilities (122374)	Nessus	MacOS X Local Security Checks	2025/3/31	2025/8/5	high
216896	CBL Mariner 2.0 Security Update: libxml2 (CVE-2025-27113)	Nessus	MarinerOS Local Security Checks	2025/2/27	2025/9/26	high
216959	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libxml2 (SUSE-SU-2025:0746-1)	Nessus	SuSE Local Security Checks	2025/3/1	2025/10/17	critical
216980	SUSE SLES15 Security Update : libxml2 (SUSE-SU-2025:0748-1)	Nessus	SuSE Local Security Checks	2025/3/1	2025/10/17	critical
232332	Photon OS 4.0: Libxml2 PHSA-2025-4.0-0765	Nessus	PhotonOS Local Security Checks	2025/3/10	2025/4/10	high
232339	Photon OS 5.0: Libxml2 PHSA-2025-5.0-0485	Nessus	PhotonOS Local Security Checks	2025/3/10	2025/4/10	high
233584	Amazon Linux 2023 : libxml2, libxml2-devel, libxml2-static (ALAS2023-2025-896)	Nessus	Amazon Linux Local Security Checks	2025/3/31	2025/10/30	critical
237754	AIX : Multiple Vulnerabilities (IJ54754)	Nessus	AIX Local Security Checks	2025/6/4	2025/6/4	high
238954	TencentOS Server 4: libxml2 (TSSA-2025:0209)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	critical
283022	MiracleLinux 7 : libxml2-2.9.1-6.6.0.2.el7.AXS7 (AXSA:2025-9781:05)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/1/13	high
281632	EulerOS Virtualization 2.10.1 : libxml2 (EulerOS-SA-2026-1004)	Nessus	Huawei Local Security Checks	2026/1/3	2026/1/3	critical
281635	EulerOS Virtualization 2.10.0 : libxml2 (EulerOS-SA-2026-1001)	Nessus	Huawei Local Security Checks	2026/1/3	2026/1/3	critical
240559	Debian dsa-5949 : libxml2 - security update	Nessus	Debian Local Security Checks	2025/6/26	2026/1/21	high
242293	Oracle Java SE Multiple Vulnerabilities (July 2025 CPU)	Nessus	Misc.	2025/7/18	2026/1/21	critical

检测

插件搜索

high

high

critical

critical

high

high

critical

high

critical

high

critical

critical

high

critical