expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - expat: Large number of prefixed XML attributes on a single tag can crash libexpat (CVE-2021-45960)

  - expat: Integer overflow in function XML_GetBuffer (CVE-2022-23852)

  - Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier     for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of     the srand function. (CVE-2012-6702)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - expat: Out-of-bounds heap read on crafted input causing crash (CVE-2016-0718)

  - The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to     trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service     (CPU consumption) via an XML file with many identifiers with the same value. (CVE-2012-0876)

  - Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-     dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML     files that cause improperly-handled reallocation failures when expanding entities. (CVE-2012-1148)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - expat: Out-of-bounds heap read on crafted input causing crash (CVE-2016-0718)

  - The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to     trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service     (CPU consumption) via an XML file with many identifiers with the same value. (CVE-2012-0876)

  - Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-     dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML     files that cause improperly-handled reallocation failures when expanding entities. (CVE-2012-1148)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses     the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service     (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML     document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already     provides the ability to disable external entity expansion, the responsibility for resolving this issue     lies with application developers; according to this argument, this entry should be REJECTed, and each     affected application would need its own CVE. (CVE-2013-0340)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the expat package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses     the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service     (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML     document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already     provides the ability to disable external entity expansion, the responsibility for resolving this issue     lies with application developers; according to this argument, this entry should be REJECTed, and each     affected application would need its own CVE. (CVE-2013-0340)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Apple iOS running on the mobile device is prior to 15. It is, therefore, affected by multiple vulnerabilities.

The version of Apple iOS running on the mobile device is prior to 14.8. It is, therefore, affected by multiple vulnerabilities.

The remote host is running a version of macOS / Mac OS X that is prior to Catalina Security Update 2021-005. It is, therefore, affected by multiple vulnerabilities, including the following:

  - Arbitrary code execution when processing a maliciously crafted image. (CVE-2021-30835, CVE-2021-30847)

  - An integer overflow issue due to insufficient input validation, which can lead to arbitrary code     execution by an unauthenticated attacker when processing a maliciously crafted PDF. (CVE-2021-30860)

  - Arbitrary code execution when processing a maliciously crafted dfont file. (CVE-2021-30841,     CVE-2021-30842, CVE-2021-30843)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 11.x prior to 11.6 Big Sur. It is, therefore, affected by multiple vulnerabilities including the following:

  - A use after free issue was addressed with improved memory management. Exploitation of this vulnerability may lead to     arbitrary code execution. (CVE-2021-30858)

  - An integer overflow was addressed with improved input validation. Exploitation of this vulnerability may lead to     arbitrary code execution. (CVE-2021-30860)

  - Insufficient checks when processing maliciously crafted dfont files may lead to arbitrary code     execution. (CVE-2021-30841, CVE-2021-30842, CVE-2021-30843)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

Kurt Seifried reports :

So here are the CVE's for the two big ones, libxml2 and expat. Both are affected by the expansion of internal entities (which can be used to consume resources) and external entities (which can cause a denial of service against other services, be used to port scan, etc.).

A billion laughs attack is a type of denial-of-service attack which is aimed at parsers of XML documents.

New expat packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix a security issue.

The version of IBM Netezza Analytics installed on the remote Linux host is 1.2.1 - 3.2.1. It is, therefore, affected by multiple vulnerabilities in the Open Source James Clark Expat component.

The remote host is affected by the vulnerability described in GLSA-201701-21 (Expat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Expat. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by enticing a user to process a specially crafted XML       file, could execute arbitrary code with the privileges of the process or       cause a Denial of Service condition.  This attack could also be used       against automated systems that arbitrarily process XML files.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
198403	RHEL 7 : expat (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198337	RHEL 5 : expat (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198331	RHEL 6 : expat (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
155536	EulerOS Virtualization 2.9.0 : expat (EulerOS-SA-2021-2784)	Nessus	Huawei Local Security Checks	critical
155509	EulerOS Virtualization 2.9.1 : expat (EulerOS-SA-2021-2756)	Nessus	Huawei Local Security Checks	critical
153711	EulerOS 2.0 SP9 : expat (EulerOS-SA-2021-2548)	Nessus	Huawei Local Security Checks	critical
153698	EulerOS 2.0 SP9 : expat (EulerOS-SA-2021-2524)	Nessus	Huawei Local Security Checks	critical
153507	Apple iOS < 15 Multiple Vulnerabilities (HT212814)	Nessus	Mobile Devices	critical
153434	Apple iOS < 14.8 Multiple Vulnerabilities (HT212807)	Nessus	Mobile Devices	critical
153432	macOS 10.15.x < Catalina Security Update 2021-005 Catalina (HT212805)	Nessus	MacOS X Local Security Checks	high
153429	macOS 11.x < 11.6 (HT212804)	Nessus	MacOS X Local Security Checks	high
149883	FreeBSD : texproc/expat2 -- billion laugh attack (5fa90ee6-bc9e-11eb-a287-e0d55e2a8bf9)	Nessus	FreeBSD Local Security Checks	critical
149858	Slackware 14.0 / 14.1 / 14.2 / current : expat (SSA:2021-143-01)	Nessus	Slackware Local Security Checks	critical
106714	IBM Netezza Analytics Open Source James Clark Expat Multiple Vulnerabilities (swg22012645)	Nessus	General	medium
96415	GLSA-201701-21 : Expat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2013-0340

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

critical

critical

medium

critical