Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - expat: Large number of prefixed XML attributes on a single tag can crash libexpat (CVE-2021-45960)

  - expat: Integer overflow in function XML_GetBuffer (CVE-2022-23852)

  - Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier     for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of     the srand function. (CVE-2012-6702)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - expat: Out-of-bounds heap read on crafted input causing crash (CVE-2016-0718)

  - The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to     trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service     (CPU consumption) via an XML file with many identifiers with the same value. (CVE-2012-0876)

  - Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-     dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML     files that cause improperly-handled reallocation failures when expanding entities. (CVE-2012-1148)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - expat: Out-of-bounds heap read on crafted input causing crash (CVE-2016-0718)

  - The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to     trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service     (CPU consumption) via an XML file with many identifiers with the same value. (CVE-2012-0876)

  - Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-     dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML     files that cause improperly-handled reallocation failures when expanding entities. (CVE-2012-1148)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The version of IBM Netezza Analytics installed on the remote Linux host is 1.2.1 - 3.2.1. It is, therefore, affected by multiple vulnerabilities in the Open Source James Clark Expat component.

ID	Name	Product	Family	Severity
198403	RHEL 7 : expat (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198337	RHEL 5 : expat (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198331	RHEL 6 : expat (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
106714	IBM Netezza Analytics Open Source James Clark Expat Multiple Vulnerabilities (swg22012645)	Nessus	General	medium

Detections

Analytics

CVE-2013-0341

No Score

Tenable Plugins

critical

critical

critical

medium