セキュリティ修正プログラム:

  - Expatで特定の入力を処理する方法に、領域外読み取りの欠陥が見つかりました。リモートの攻撃者は、Expatライブラリを使用しているアプリケーションによって解析されたときにアプリケーションをクラッシュさせるか、アプリケーションを実行しているユーザーのアクセス許可で任意のコードを実行する特別に細工されたXMLを送信する可能性があります。（CVE-2016-0718）

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  Expatにより、コンテキスト依存の攻撃者が、バッファオーバーフローを引き起こす無効な形式の入力ドキュメントを介して、サービス拒否（クラッシュ）を引き起こしたり、任意のコードを実行したりする可能性があります。（CVE-2016-0718）

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Gustavo Grieco reports :

The Expat XML parser mishandles certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. The overflows can manifest as a segmentation fault or as memory corruption during a parse operation. The bugs allow for a denial of service attack in many applications by an unauthenticated attacker, and could conceivably result in remote code execution.

This update for expat fixes the following security issues :

  - CVE-2015-1283: Fixed multiple integer overflows that     could lead to buffer overflows [boo#980391]

  - CVE-2016-0718: Fixed Expat XML parser that mishandles     certain kinds of malformed input documents [boo#979441].

According to its self-reported version number, the Tenable Nessus application running on the remote host is 6.x prior to 6.8. It is, therefore, affected by multiple vulnerabilities :

  - A buffer overflow condition exists in the Expat XML     parser due to improper validation of user-supplied input     when handling malformed input documents. An     authenticated, remote attacker can exploit this to cause     a denial of service condition or the execution of     arbitrary code. (CVE-2016-0718)

  - A stored cross-site (XSS) scripting vulnerability exists     that can be exploited by an authenticated, remote     attacker that has user-level access to the Nessus user     interface. (CVE-2016-1000028)

  - Multiple stored cross-site (XSS) scripting     vulnerabilities exist that can be exploited by an     authenticated, remote attacker that has     administrative-level access to the Nessus user     interface. These issues would only affect other users     with administrative access. (CVE-2016-1000029)

Mozilla Firefox was updated to 48.0 to fix security issues, bugs, and deliver various improvements.

The following major changes are included :

  - Process separation (e10s) is enabled for some users

  - Add-ons that have not been verified and signed by     Mozilla will not load

  - WebRTC enhancements

  - The media parser has been redeveloped using the Rust     programming language

  - better Canvas performance with speedy Skia support

  - Now requires NSS 3.24

The following security issues were fixed: (boo#991809)

  - CVE-2016-2835/CVE-2016-2836: Miscellaneous memory safety     hazards

  - CVE-2016-2830: Favicon network connection can persist     when page is closed

  - CVE-2016-2838: Buffer overflow rendering SVG with     bidirectional content

  - CVE-2016-2839: Cairo rendering crash due to memory     allocation issue with FFmpeg 0.10

  - CVE-2016-5251: Location bar spoofing via data URLs with     malformed/invalid mediatypes

  - CVE-2016-5252: Stack underflow during 2D graphics     rendering

  - CVE-2016-0718: Out-of-bounds read during XML parsing in     Expat library

  - CVE-2016-5254: Use-after-free when using alt key and     toplevel menus

  - CVE-2016-5255: Crash in incremental garbage collection     in JavaScript

  - CVE-2016-5258: Use-after-free in DTLS during WebRTC     session shutdown

  - CVE-2016-5259: Use-after-free in service workers with     nested sync events

  - CVE-2016-5260: Form input type change from password to     text can store plain text password in session restore     file

  - CVE-2016-5261: Integer overflow in WebSockets during     data buffering

  - CVE-2016-5262: Scripts on marquee tag can execute in     sandboxed iframes

  - CVE-2016-2837: Buffer overflow in ClearKey Content     Decryption Module (CDM) during video playback

  - CVE-2016-5263: Type confusion in display transformation

  - CVE-2016-5264: Use-after-free when applying SVG effects

  - CVE-2016-5265: Same-origin policy violation using local     HTML file and saved shortcut file

  - CVE-2016-5266: Information disclosure and local file     manipulation through drag and drop

  - CVE-2016-5268: Spoofing attack through text injection     into internal error pages

  - CVE-2016-5250: Information disclosure through Resource     Timing API during page navigation

The following non-security changes are included :

  - The AppData description and screenshots were updated.

  - Fix Firefox crash on startup on i586 (boo#986541)

  - The Selenium WebDriver may have caused Firefox to crash     at startup

  - fix build issues with gcc/binutils combination used in     Leap 42.2 (boo#984637)

  - Fix running on 48bit va aarch64 (boo#984126)

  - fix XUL dialog button order under KDE session     (boo#984403)

Mozilla NSS was updated to 3.24 as a dependency.

Changes in mozilla-nss :

  - NSS softoken updated with latest NIST guidance

  - NSS softoken updated to allow NSS to run in FIPS Level 1     (no password)

  - Various added and deprecated functions 

  - Remove most code related to SSL v2, including the     ability to actively send a SSLv2-compatible client     hello.

  - Protect against the Cachebleed attack.

  - Disable support for DTLS compression.

  - Improve support for TLS 1.3. This includes support for     DTLS 1.3. (experimental)

An update for expat is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Expat is a C library for parsing XML documents.

Security Fix(es) :

* An out-of-bounds read flaw was found in the way Expat processed certain input. A remote attacker could send specially crafted XML that, when parsed by an application using the Expat library, would cause that application to crash or, possibly, execute arbitrary code with the permission of the user running the application.
(CVE-2016-0718)

Red Hat would like to thank Gustavo Grieco for reporting this issue.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2824 advisory.

    - updated security fix for CVE-2016-0718

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - An out-of-bounds read flaw was found in the way Expat     processed certain input. A remote attacker could send     specially crafted XML that, when parsed by an     application using the Expat library, would cause that     application to crash or, possibly, execute arbitrary     code with the permission of the user running the     application. (CVE-2016-0718)

The version of Apple iTunes installed on the remote Windows host is prior to 12.6. It is, therefore, affected by multiple vulnerabilities :

  - Multiple vulnerabilities exist in the expat component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2009-3270,     CVE-2009-3560, CVE-2009-3720, CVE-2012-1147,     CVE-2012-1148, CVE-2012-6702, CVE-2015-1283,     CVE-2016-0718, CVE-2016-4472, CVE-2016-5300)

  - Multiple vulnerabilities exist in the SQLite component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities by convincing a user to     open a specially crafted file, to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2013-7443,     CVE-2015-3414, CVE-2015-3415, CVE-2015-3416,     CVE-2015-3717, CVE-2015-6607, CVE-2016-6153)

  - An information disclosure vulnerability exists in the     APNs server component due to client certificates being     transmitted in cleartext. A man-in-the-middle attacker     can exploit this to disclose sensitive information.
    (CVE-2017-2383)

  - A use-after-free error exists in the WebKit component     due to improper handling of RenderBox objects. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-2463)

  - Multiple universal cross-site scripting (XSS)     vulnerabilities exist in the WebKit component due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these     vulnerabilities, by convincing a user to visit a     specially crafted web page, to execute arbitrary script     code in a user's browser session. (CVE-2017-2479,     CVE-2017-2480, CVE-2017-2493)

  - An integer overflow condition exists in the libxslt     component in the xsltAddTextString() function in     transform.c due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause an out-of-bounds write, resulting in the     execution of arbitrary code. (CVE-2017-5029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iTunes running on the remote host is prior to 12.6. It is, therefore, affected by multiple vulnerabilities :

  - Multiple vulnerabilities exist in the expat component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2009-3270,     CVE-2009-3560, CVE-2009-3720, CVE-2012-1147,     CVE-2012-1148, CVE-2012-6702, CVE-2015-1283,     CVE-2016-0718, CVE-2016-4472, CVE-2016-5300)

  - Multiple vulnerabilities exist in the SQLite component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities by convincing a user to     open a specially crafted file, to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2013-7443,     CVE-2015-3414, CVE-2015-3415, CVE-2015-3416,     CVE-2015-3717, CVE-2015-6607, CVE-2016-6153)

  - An information disclosure vulnerability exists in the     APNs server component due to client certificates being     transmitted in cleartext. A man-in-the-middle attacker     can exploit this to disclose sensitive information.
    (CVE-2017-2383)

  - A use-after-free error exists in the WebKit component     due to improper handling of RenderBox objects. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-2463)

  - Multiple universal cross-site scripting (XSS)     vulnerabilities exist in the WebKit component due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these     vulnerabilities, by convincing a user to visit a     specially crafted web page, to execute arbitrary script     code in a user's browser session. (CVE-2017-2479,     CVE-2017-2480, CVE-2017-2493)

  - An integer overflow condition exists in the libxslt     component in the xsltAddTextString() function in     transform.c due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause an out-of-bounds write, resulting in the     execution of arbitrary code. (CVE-2017-5029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iTunes installed on the remote macOS or Mac OS X host is prior to 12.6. It is, therefore, affected by multiple vulnerabilities :

  - Multiple vulnerabilities exist in the expat component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2009-3270,     CVE-2009-3560, CVE-2009-3720, CVE-2012-1147,     CVE-2012-1148, CVE-2012-6702, CVE-2015-1283,     CVE-2016-0718, CVE-2016-4472, CVE-2016-5300)

  - Multiple vulnerabilities exist in the SQLite component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities by convincing a user to     open a specially crafted file, to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2013-7443,     CVE-2015-3414, CVE-2015-3415, CVE-2015-3416,     CVE-2015-3717, CVE-2015-6607, CVE-2016-6153)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Python reports :

Multiple vulnerabilities have been fixed in Python 2.7.14. Please refer to the CVE list for details.

python release notes :

Multiple vulnerabilities has been fixed in this release. Please refer to the CVE list for details.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute     arbitrary code via a malformed input document, which triggers a buffer overflow. (CVE-2016-0718)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
95867	Scientific Linux セキュリティ更新: SL6.x、SL7.x i386/x86_64のexpat（20161128）	Nessus	Scientific Linux Local Security Checks	2016/12/15	2021/1/14	critical
219189	Linux Distros のパッチ未適用の脆弱性: CVE-2016-0718	Nessus	Misc.	2025/3/4	2025/10/27	critical
91267	FreeBSD : expat -- denial of service vulnerability on malformed input (57b3aba7-1e25-11e6-8dd3-002590263bf5)	Nessus	FreeBSD Local Security Checks	2016/5/20	2021/1/4	critical
91407	openSUSE Security Update : expat (openSUSE-2016-660)	Nessus	SuSE Local Security Checks	2016/6/1	2021/1/19	critical
92465	Tenable Nessus 6.x < 6.8 Multiple Vulnerabilities	Nessus	CGI abuses	2016/7/20	2024/6/12	critical
92853	openSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2016-960)	Nessus	SuSE Local Security Checks	2016/8/11	2021/1/19	critical
95373	CentOS 6 / 7 : expat (CESA-2016:2824)	Nessus	CentOS Local Security Checks	2016/11/29	2021/1/4	critical
95379	Oracle Linux 6 / 7 : expat (ELSA-2016-2824)	Nessus	Oracle Linux Local Security Checks	2016/11/29	2024/10/22	critical
95867	Scientific Linux Security Update : expat on SL6.x, SL7.x i386/x86_64 (20161128)	Nessus	Scientific Linux Local Security Checks	2016/12/15	2021/1/14	critical
100025	Apple iTunes < 12.6 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	2017/5/8	2019/11/13	critical
100026	Apple iTunes < 12.6 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	2017/5/8	2019/11/13	critical
100027	Apple iTunes < 12.6 Multiple Vulnerabilities (macOS) (credentialed check)	Nessus	MacOS X Local Security Checks	2017/5/8	2019/11/13	critical
103796	FreeBSD : Python 2.7 -- multiple vulnerabilities (9164f51e-ae20-11e7-a633-009c02a2ab30)	Nessus	FreeBSD Local Security Checks	2017/10/12	2021/1/4	critical
109594	FreeBSD : python 2.7 -- multiple vulnerabilities (8719b935-8bae-41ad-92ba-3c826f651219)	Nessus	FreeBSD Local Security Checks	2018/5/7	2024/10/11	critical
219189	Linux Distros Unpatched Vulnerability : CVE-2016-0718	Nessus	Misc.	2025/3/4	2025/10/27	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical