dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the "<!DOCTYPE html" substring in a crafted HTML document.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

According to the versions of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The xmlBufAttrSerializeTxtContent function in xmlsave.c     in libxml2 allows context-dependent attackers to cause     a denial of service (out-of-bounds read and application     crash) via a non-UTF-8 attribute value, related to     serialization. NOTE: this vulnerability may be a     duplicate of CVE-2016-3627.(CVE-2016-4483)

  - xmlParseBalancedChunkMemoryRecover in parser.c in     libxml2 before 2.9.10 has a memory leak related to     newDoc->oldNs.(CVE-2019-19956)

  - dict.c in libxml2 allows remote attackers to cause a     denial of service (heap-based buffer over-read and     application crash) via an unexpected character     immediately after the '<!DOCTYPE html' substring in a     crafted HTML document.(CVE-2015-8806)

  - ** DISPUTED ** libxml2 2.9.4, when used in recover     mode, allows remote attackers to cause a denial of     service (NULL pointer dereference) via a crafted XML     document. NOTE: The maintainer states 'I would disagree     of a CVE with the Recover parsing option which should     only be used for manual recovery at least for XML     parser.'(CVE-2017-5969)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - dict.c in libxml2 allows remote attackers to cause a     denial of service (heap-based buffer over-read and     application crash) via an unexpected character     immediately after the '<!DOCTYPE html' substring in a     crafted HTML document.(CVE-2015-8806)

  - libxml2 2.9.4, when used in recover mode, allows remote     attackers to cause a denial of service (NULL pointer     dereference) via a crafted XML document. NOTE: The     maintainer states 'I would disagree of a CVE with the     Recover parsing option which should only be used for     manual recovery at least for XML     parser.'(CVE-2017-5969)

  - The htmlParseTryOrFinish function in HTMLparser.c in     libxml2 2.9.4 allows attackers to cause a denial of     service (buffer over-read) or information     disclosure.(CVE-2017-8872)

  - libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a     stack-based buffer overflow. The function     xmlSnprintfElementContent in valid.c is supposed to     recursively dump the element content definition into a     char buffer 'buf' of size 'size'. At the end of the     routine, the function may strcat two more characters     without checking whether the current strlen(buf) + 2 <     size. This vulnerability causes programs that use     libxml2, such as PHP, to crash.(CVE-2017-9048)

  - libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a     heap-based buffer over-read in the     xmlDictComputeFastKey function in dict.c. This     vulnerability causes programs that use libxml2, such as     PHP, to crash. This vulnerability exists because of an     incomplete fix for libxml2 Bug 759398.(CVE-2017-9049)

  - libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a     heap-based buffer over-read in the xmlDictAddString     function in dict.c. This vulnerability causes programs     that use libxml2, such as PHP, to crash. This     vulnerability exists because of an incomplete fix for     CVE-2016-1839.(CVE-2017-9050)

  - The xz_decomp function in xzlib.c in libxml2 2.9.8, if
    --with-lzma is used, allows remote attackers to cause a     denial of service (infinite loop) via a crafted XML     file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated     by xmllint, a different vulnerability than     CVE-2015-8035.(CVE-2018-9251)

  - libxml2 2.9.8, if --with-lzma is used, allows remote     attackers to cause a denial of service (infinite loop)     via a crafted XML file that triggers     LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a     different vulnerability than CVE-2015-8035 and     CVE-2018-9251.(CVE-2018-14567)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the '<!DOCTYPE html' substring in a crafted HTML document. (CVE-2015-8806)

The remote host is affected by the vulnerability described in GLSA-201701-37 (libxml2: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libxml2. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user or automated system to process a       specially crafted XML document, possibly resulting in execution of       arbitrary code with the privileges of the process or a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

This update for libxml2 fixes the following security issues :

  - CVE-2016-2073, CVE-2015-8806, CVE-2016-1839: A     Heap-buffer overread was fixed in libxml2/dict.c     [bsc#963963, bsc#965283, bsc#981114].

  - CVE-2016-4483: Code was added to avoid an out of bound     access when serializing malformed strings [bsc#978395].

  - CVE-2016-1762: Fixed a heap-based buffer overread in     xmlNextChar [bsc#981040].

  - CVE-2016-1834: Fixed a heap-buffer-overflow in     xmlStrncat [bsc#981041].

  - CVE-2016-1833: Fixed a heap-based buffer overread in     htmlCurrentChar [bsc#981108].

  - CVE-2016-1835: Fixed a heap use-after-free in     xmlSAX2AttributeNs [bsc#981109].

  - CVE-2016-1837: Fixed a heap use-after-free in     htmlParsePubidLiteral and htmlParseSystemiteral     [bsc#981111].

  - CVE-2016-1838: Fixed a heap-based buffer overread in     xmlParserPrintFileContextInternal [bsc#981112].

  - CVE-2016-1840: Fixed a heap-buffer-overflow in     xmlFAParsePosCharGroup [bsc#981115].

  - CVE-2016-4447: Fixed a heap-based buffer-underreads due     to xmlParseName [bsc#981548].

  - CVE-2016-4448: Fixed some format string warnings with     possible format string vulnerability [bsc#981549],

  - CVE-2016-4449: Fixed inappropriate fetch of entities     content [bsc#981550].

  - CVE-2016-3705: Fixed missing increment of recursion     counter.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libxml2 fixes the following security issues :

  - CVE-2016-2073, CVE-2015-8806, CVE-2016-1839: A     Heap-buffer overread was fixed in libxml2/dict.c     [bsc#963963, bsc#965283, bsc#981114].

  - CVE-2016-4483: Code was added to avoid an out of bound     access when serializing malformed strings [bsc#978395].

  - CVE-2016-1762: Fixed a heap-based buffer overread in     xmlNextChar [bsc#981040].

  - CVE-2016-1834: Fixed a heap-buffer-overflow in     xmlStrncat [bsc#981041].

  - CVE-2016-1833: Fixed a heap-based buffer overread in     htmlCurrentChar [bsc#981108].

  - CVE-2016-1835: Fixed a heap use-after-free in     xmlSAX2AttributeNs [bsc#981109].

  - CVE-2016-1837: Fixed a heap use-after-free in     htmlParsePubidLiteral and htmlParseSystemiteral     [bsc#981111].

  - CVE-2016-1838: Fixed a heap-based buffer overread in     xmlParserPrintFileContextInternal [bsc#981112].

  - CVE-2016-1840: Fixed a heap-buffer-overflow in     xmlFAParsePosCharGroup [bsc#981115].

  - CVE-2016-4447: Fixed a heap-based buffer-underreads due     to xmlParseName [bsc#981548].

  - CVE-2016-4448: Fixed some format string warnings with     possible format string vulnerability [bsc#981549],

  - CVE-2016-4449: Fixed inappropriate fetch of entities     content [bsc#981550].

  - CVE-2016-3705: Fixed missing increment of recursion     counter.

This update was imported from the SUSE:SLE-12:Update update project.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2994-1 advisory.

    It was discovered that libxml2 incorrectly handled certain malformed documents. If a user or automated     system were tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to     crash, resulting in a denial of service. (CVE-2015-8806, CVE-2016-2073, CVE-2016-3627, CVE-2016-3705,     CVE-2016-4447)

    It was discovered that libxml2 incorrectly handled certain malformed documents. If a user or automated     system were tricked into opening a specially crafted document, an attacker could cause libxml2 to crash,     resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-1762, CVE-2016-1834)

    Mateusz Jurczyk discovered that libxml2 incorrectly handled certain malformed documents. If a user or     automated system were tricked into opening a specially crafted document, an attacker could cause libxml2     to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-1833,     CVE-2016-1838, CVE-2016-1839)

    Wei Lei and Liu Yang discovered that libxml2 incorrectly handled certain malformed documents. If a user or     automated system were tricked into opening a specially crafted document, an attacker could cause libxml2     to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-1835,     CVE-2016-1837)

    Wei Lei and Liu Yang discovered that libxml2 incorrectly handled certain malformed documents. If a user or     automated system were tricked into opening a specially crafted document, an attacker could cause libxml2     to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to     Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-1836)

    Kostya Serebryany discovered that libxml2 incorrectly handled certain malformed documents. If a user or     automated system were tricked into opening a specially crafted document, an attacker could cause libxml2     to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-1840)

    It was discovered that libxml2 would load certain XML external entities. If a user or automated system     were tricked into opening a specially crafted document, an attacker could possibly obtain access to     arbitrary files or cause resource consumption. (CVE-2016-4449)

    Gustavo Grieco discovered that libxml2 incorrectly handled certain malformed documents. If a user or     automated system were tricked into opening a specially crafted document, an attacker could possibly cause     libxml2 to crash, resulting in a denial of service. (CVE-2016-4483)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause a denial of service against the application, or potentially the execution of arbitrary code with the privileges of the user running the application.

For Debian 7 'Wheezy', these problems have been fixed in version 2.8.0+dfsg1-7+wheezy6.

We recommend that you upgrade your libxml2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause a denial-of-service against the application, or potentially the execution of arbitrary code with the privileges of the user running the application.

ID	Name	Product	Family	Severity
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	critical
135636	EulerOS Virtualization 3.0.2.2 : libxml2 (EulerOS-SA-2020-1474)	Nessus	Huawei Local Security Checks	high
130673	EulerOS 2.0 SP5 : libxml2 (EulerOS-SA-2019-2211)	Nessus	Huawei Local Security Checks	critical
97476	F5 Networks BIG-IP : libxml2 vulnerability (K04450715)	Nessus	F5 Networks Local Security Checks	high
96541	GLSA-201701-37 : libxml2: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
93154	SUSE SLES11 Security Update : libxml2 (SUSE-SU-2016:1604-1)	Nessus	SuSE Local Security Checks	critical
91656	SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2016:1538-1)	Nessus	SuSE Local Security Checks	critical
91639	openSUSE Security Update : libxml2 (openSUSE-2016-733)	Nessus	SuSE Local Security Checks	critical
91499	Ubuntu 14.04 LTS / 16.04 LTS : libxml2 vulnerabilities (USN-2994-1)	Nessus	Ubuntu Local Security Checks	high
91472	Debian DLA-503-1 : libxml2 security update	Nessus	Debian Local Security Checks	high
91447	Debian DSA-3593-1 : libxml2 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2015-8806

high

Tenable Plugins

critical

high

critical

high

critical

critical

critical

critical

high

high

high