Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libxml2: Use after free via namespace node in XPointer ranges (CVE-2016-4658)

  - libxml2: Missing validation for external entities in xmlParsePEReference (CVE-2017-7375)

  - libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer     uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to     cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read     arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be     argued that because libxml2 already provides the ability to disable external entity expansion, the     responsibility for resolving this issue lies with application developers; according to this argument, this     entry should be REJECTed and each affected application would need its own CVE. (CVE-2013-0339)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

According to its self-reported version number, the remote Juniper Junos device is affected by a Multiple vulnerabilities in libxml2:

- Format string vulnerability in libxml2 before 2.9.4 allows   attackers to have unspecified impact via format string   specifiers in unknown vectors.(CVE-2016-4448)   
- The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and   earlier, when used in recovery mode, allows context-dependent   attackers to cause a denial of service (infinite recursion, stack   consumption, and application crash) via a crafted XML document.   (CVE-2016-3627)

Update to latest upstream release, includes several security related fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tenable Log Correlation Engine (LCE) installed on the remote host is prior to 4.8.1. It is, therefore, affected by the following vulnerabilities :

  - Multiple cross-site scripting (XSS) vulnerabilities     exist in the Handlebars library in the     lib/handlebars/utils.js script due to a failure to     properly escape input passed as unquoted attributes to     templates. An unauthenticated, remote attacker can     exploit these vulnerabilities, via a specially crafted     request, to execute arbitrary script code in a user's     browser session. (CVE-2015-8861, CVE-2015-8862)

  - A heap-based buffer overflow condition exists in the     Perl-Compatible Regular Expressions (PCRE) component     that is triggered when processing nested back references     in a duplicate named group. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1283)

  - An out-of-bounds read error exists in the libxml2     component in parserInternals.c due to improper parsing     of characters in an XML file. An unauthenticated, remote     attacker can exploit this to disclose sensitive     information or cause a denial of service condition.
    (CVE-2016-1833)

  - An overflow condition exists in the libxml2 component in     xmlstring.c due to improper validation of user-supplied     input when handling a string with NULL. An     unauthenticated, remote attacker can exploit this, via a     specially crafted file, to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1834)

  - Multiple use-after-free errors exist in the libxml2     component in parser.c that is triggered when parsing     complex names. An unauthenticated, remote attacker can     exploit these issues, via a specially crafted file, to     dereference already freed memory and potentially execute     arbitrary code. (CVE-2016-1835, CVE-2016-1836)

  - Multiple heap-based buffer overflow conditions exist in     the libxml2 component in HTMLparser.c and xmlregexp.c     due to improper validation of user-supplied input when     parsing characters in a range. An unauthenticated,     remote attacker can exploit these issues, via a     specially crafted file, to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1837, CVE-2016-1839, CVE-2016-1840)

  - Multiple out-of-bounds read errors exist in the libxml2     component in parser.c. An unauthenticated, remote     attacker can exploit these issues to disclose sensitive     information or cause a denial of service condition.
    (CVE-2016-1838, CVE-2016-4447)

  - A heap buffer overflow condition exists in the OpenSSL     component in the EVP_EncodeUpdate() function within file     crypto/evp/encode.c that is triggered when handling a     large amount of input data. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition. (CVE-2016-2105)

  - A heap buffer overflow condition exists in the OpenSSL     component in the EVP_EncryptUpdate() function within     file crypto/evp/evp_enc.c that is triggered when     handling a large amount of input data after a previous     call occurs to the same function with a partial block.
    An unauthenticated, remote attacker can exploit this to     cause a denial of service condition. (CVE-2016-2106)

  - Flaws exist in the aesni_cbc_hmac_sha1_cipher()     function in file crypto/evp/e_aes_cbc_hmac_sha1.c and     the aesni_cbc_hmac_sha256_cipher() function in file     crypto/evp/e_aes_cbc_hmac_sha256.c that are triggered     when the connection uses an AES-CBC cipher and AES-NI     is supported by the server. A man-in-the-middle attacker     can exploit these to conduct a padding oracle attack,     resulting in the ability to decrypt the network traffic.
    (CVE-2016-2107)

  - A remote code execution vulnerability exists in the     OpenSSL component in the ASN.1 encoder due to an     underflow condition that occurs when attempting to     encode the value zero represented as a negative integer.
    An unauthenticated, remote attacker can exploit this to     corrupt memory, resulting in the execution of arbitrary     code. (CVE-2016-2108)

  - Multiple unspecified flaws exist in the d2i BIO     functions when reading ASN.1 data from a BIO due to     invalid encoding causing a large allocation of memory.
    An unauthenticated, remote attacker can exploit these to     cause a denial of service condition through resource     exhaustion. (CVE-2016-2109)

  - An out-of-bounds read error exists in the     X509_NAME_oneline() function within file     crypto/x509/x509_obj.c when handling very long ASN1     strings. An unauthenticated, remote attacker can exploit     this to disclose the contents of stack memory.
    (CVE-2016-2176)

  - An overflow condition exists in the Perl-Compatible     Regular Expressions (PCRE) component due to improper     validation of user-supplied input when handling the     (*ACCEPT) verb. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition or     the execution of arbitrary code. (CVE-2016-3191)

  - A flaw exists in the libxml2 component in parser.c that     occurs when handling XML content in recovery mode. An     unauthenticated, remote attacker can exploit this to     cause a stack exhaustion, resulting in a denial of     service condition. (CVE-2016-3627)

  - A flaw exists in the libxml2 component in parser.c due     to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a stack exhaustion, resulting in a denial of     service condition. (CVE-2016-3705)

  - A format string flaw exists in the libxml2 component due     to improper use of string format specifiers (e.g. %s and     %x). An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     execution of arbitrary code. (CVE-2016-4448)

  - An XML external entity injection vulnerability exists in     parser.c due to improper parsing of XML data. An     unauthenticated, remote attacker can exploit this, via     specially crafted XML data, to disclose arbitrary files     or cause a denial of service condition. (CVE-2016-4449)

  - An out-of-bounds read error exists in the libxml2     component in xmlsave.c that occurs when handling XML     content in recovery mode. An unauthenticated, remote     attacker can exploit this to disclose sensitive     information or cause a denial of service condition.
    (CVE-2016-4483)

  - A security bypass vulnerability exists in the libcurl     component due to the program attempting to resume TLS     sessions even if the client certificate fails. An     unauthenticated, remote attacker can exploit this to     bypass validation mechanisms. (CVE-2016-5419)

  - An information disclosure vulnerability exists in the     libcurl component due to the program reusing TLS     connections with different client certificates. An     unauthenticated, remote attacker can exploit this to     disclose sensitive cross-realm information.
    (CVE-2016-5420)

  - A use-after-free error exists in the libcurl component     that is triggered as connection pointers are not     properly cleared for easy handles. An unauthenticated,     remote attacker can exploit this to dereference already     freed memory, potentially resulting in the execution of     arbitrary code. (CVE-2016-5421)

  - Multiple stored cross-site scripting (XSS)   	vulnerabilities exist due to improper validation of   	user-supplied input. An authenticated, remote attacker   	can exploit these, via a specially crafted request, to   	execute arbitrary script code in a user's browsers   	session. (CVE-2016-9261)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3235-1 advisory.

    It was discovered that libxml2 incorrectly handled format strings. If a user or automated system were     tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to crash,     resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS, and Ubuntu     16.04 LTS. (CVE-2016-4448)

    It was discovered that libxml2 incorrectly handled certain malformed documents. If a user or automated     system were tricked into opening a specially crafted document, an attacker could cause libxml2 to crash,     resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-4658)

    Nick Wellnhofer discovered that libxml2 incorrectly handled certain malformed documents. If a user or     automated system were tricked into opening a specially crafted document, an attacker could cause libxml2     to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-5131)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libxml2 fixes the following security issues :

  - CVE-2016-2073, CVE-2015-8806, CVE-2016-1839: A     Heap-buffer overread was fixed in libxml2/dict.c     [bsc#963963, bsc#965283, bsc#981114].

  - CVE-2016-4483: Code was added to avoid an out of bound     access when serializing malformed strings [bsc#978395].

  - CVE-2016-1762: Fixed a heap-based buffer overread in     xmlNextChar [bsc#981040].

  - CVE-2016-1834: Fixed a heap-buffer-overflow in     xmlStrncat [bsc#981041].

  - CVE-2016-1833: Fixed a heap-based buffer overread in     htmlCurrentChar [bsc#981108].

  - CVE-2016-1835: Fixed a heap use-after-free in     xmlSAX2AttributeNs [bsc#981109].

  - CVE-2016-1837: Fixed a heap use-after-free in     htmlParsePubidLiteral and htmlParseSystemiteral     [bsc#981111].

  - CVE-2016-1838: Fixed a heap-based buffer overread in     xmlParserPrintFileContextInternal [bsc#981112].

  - CVE-2016-1840: Fixed a heap-buffer-overflow in     xmlFAParsePosCharGroup [bsc#981115].

  - CVE-2016-4447: Fixed a heap-based buffer-underreads due     to xmlParseName [bsc#981548].

  - CVE-2016-4448: Fixed some format string warnings with     possible format string vulnerability [bsc#981549],

  - CVE-2016-4449: Fixed inappropriate fetch of entities     content [bsc#981550].

  - CVE-2016-3705: Fixed missing increment of recursion     counter.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X version 10.11.x prior to 10.11.6, and the following components contain vulnerabilities :

 - ACMP4AACBaseDecoder
 - Audio
 - CFNetwork
 - CoreGraphics
 - DspFuncLib
 - FaceTime
 - Graphics
 - IOHIDFamily
 - IOSurface
 - ImageIO
 - Kernel
 - QuickTime
 - Safari
 - Sandbox
 - libxml2

Versions of Apple TV 9.2.x prior to 9.2.2 are affected by multiple vulnerabilities in the following components :

 - CFNetwork
 - CoreGraphics
 - IOAcceleratorFamily
 - IOHIDFamily
 - ImageIO
 - Kernel
 - libxml2
 - libxslt
 - Sandbox

The remote host is running a version of Mac OS X that is 10.9.5 or 10.10.5 and is missing Security Update 2016-004. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache_mod_php (affects 10.10.5 only)
  - CoreGraphics
  - ImageIO
  - libxml2
  - libxslt

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X that is 10.11.x prior to 10.11.6. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache_mod_php
  - Audio
  - bsdiff
  - CFNetwork
  - CoreGraphics
  - FaceTime
  - Graphics Drivers
  - ImageIO
  - Intel Graphics Driver
  - IOHIDFamily
  - IOKit
  - IOSurface
  - Kernel
  - libc++abi
  - libexpat
  - LibreSSL
  - libxml2
  - libxslt
  - Login Window
  - OpenSSL
  - QuickTime
  - Safari Login AutoFill
  - Sandbox Profiles

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

According to its banner, the version of the remote Apple TV device is prior to 9.2.2. It is, therefore, affected by multiple vulnerabilities in the following components :

  - CoreGraphics
  - ImageIO
  - IOAcceleratorFamily
  - IOHIDFamily
  - Kernel
  - libxml2
  - libxslt
  - Sandbox Profiles
  - WebKit
  - WebKit Page Loading

Note that only 4th generation models are affected by the vulnerabilities.

The version of Apple iTunes running on the remote Windows host is prior to 12.4.2. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist in the libxslt     component due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     execution of arbitrary code. (CVE-2016-1684,     CVE-2016-4607, CVE-2016-4608, CVE-2016-4609,     CVE-2016-4610, CVE-2016-4612)

  - Multiple memory corruption issues exist in the libxml2     component that allow a remote attacker to cause a denial     of service condition or the execution of arbitrary code.
    (CVE-2016-1836, CVE-2016-4447, CVE-2016-4448,     CVE-2016-4483, CVE-2016-4614, CVE-2016-4615,     CVE-2016-4616, CVE-2016-4619)

  - An XXE (Xml eXternal Entity) injection vulnerability     exists in the libxml2 component due to an incorrectly     configured XML parser accepting XML external entities     from an untrusted source. A remote attacker can exploit     this, via a specially crafted XML file, to disclose     arbitrary files and user information. (CVE-2016-4449)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iTunes installed on the remote Windows host is prior to 12.4.2. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist in the libxslt     component due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     execution of arbitrary code. (CVE-2016-1684,     CVE-2016-4607, CVE-2016-4608, CVE-2016-4609,     CVE-2016-4610, CVE-2016-4612)

  - Multiple memory corruption issues exist in the libxml2     component that allow a remote attacker to cause a denial     of service condition or the execution of arbitrary code.
    (CVE-2016-1836, CVE-2016-4447, CVE-2016-4448,     CVE-2016-4483, CVE-2016-4614, CVE-2016-4615,     CVE-2016-4616, CVE-2016-4619)

  - An XXE (Xml eXternal Entity) injection vulnerability     exists in the libxml2 component due to an incorrectly     configured XML parser accepting XML external entities     from an untrusted source. A remote attacker can exploit     this, via a specially crafted XML file, to disclose     arbitrary files and user information. (CVE-2016-4449)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of iOS running on the mobile device is prior to 9.3.3. It is, therefore, affected by multiple vulnerabilities, the most serious of which can result in remote code execution, in the following components :

  - Calendar
  - CoreGraphics
  - FaceTime
  - ImageIO
  - IOAcceleratorFamily
  - IOHIDFamily
  - Kernel
  - libxml2
  - libxslt
  - Safari
  - Sandbox Profiles
  - Siri Contacts
  - Web Media
  - WebKit
  - WebKit JavaScript Bindings
  - WebKit Page Loading

A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an application linked against libxml2, would cause the application to crash or execute arbitrary code with the permissions of the user running the application.
(CVE-2016-1834 , CVE-2016-1840)

Multiple denial of service flaws were found in libxml2. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, could cause that application to crash. (CVE-2016-1762 , CVE-2016-1833 , CVE-2016-1835 , CVE-2016-1836 , CVE-2016-1837 , CVE-2016-1838 , CVE-2016-1839 , CVE-2016-3627 , CVE-2016-3705 , CVE-2016-4447 , CVE-2016-4448 , CVE-2016-4449)

Security Fix(es) :

A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an application linked against libxml2, would cause the application to crash or execute arbitrary code with the permissions of the user running the application.
(CVE-2016-1834, CVE-2016-1840)

Multiple denial of service flaws were found in libxml2. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, could cause that application to crash. (CVE-2016-1762, CVE-2016-1833, CVE-2016-1835, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, CVE-2016-3627, CVE-2016-3705, CVE-2016-4447, CVE-2016-4448, CVE-2016-4449)

An update for libxml2 is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

[Updated 18 July 2016] This advisory has been updated to push packages into the Red Hat Enterprise Linux 6 Desktop channels. The packages included in this revised update have not been changed in any way from the packages included in the original advisory.

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es) :

A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an application linked against libxml2, would cause the application to crash or execute arbitrary code with the permissions of the user running the application.
(CVE-2016-1834, CVE-2016-1840)

Multiple denial of service flaws were found in libxml2. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, could cause that application to crash. (CVE-2016-1762, CVE-2016-1833, CVE-2016-1835, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, CVE-2016-3627, CVE-2016-3705, CVE-2016-4447, CVE-2016-4448, CVE-2016-4449)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Update doc/redhat.gif in tarball

  - Add libxml2-oracle-enterprise.patch and update logos in     tarball

  - Heap-based buffer overread in xmlNextChar     (CVE-2016-1762)

  - Bug 763071: Heap-buffer-overflow in xmlStrncat     (CVE-2016-1834)

  - Bug 757711: Heap-buffer-overflow in     xmlFAParsePosCharGroup (CVE-2016-1840)

  - Bug 758588: Heap-based buffer overread in     xmlParserPrintFileContextInternal (CVE-2016-1838)

  - Bug 758605: Heap-based buffer overread in     xmlDictAddString (CVE-2016-1839)

  - Bug 759398: Heap use-after-free in xmlDictComputeFastKey     (CVE-2016-1836)

  - Fix inappropriate fetch of entities content     (CVE-2016-4449)

  - Heap use-after-free in htmlParsePubidLiteral and     htmlParseSystemiteral (CVE-2016-1837)

  - Heap use-after-free in xmlSAX2AttributeNs     (CVE-2016-1835)

  - Heap-based buffer-underreads due to xmlParseName     (CVE-2016-4447)

  - Heap-based buffer overread in htmlCurrentChar     (CVE-2016-1833)

  - Add missing increments of recursion depth counter to XML     parser. (CVE-2016-3705)

  - Avoid building recursive entities (CVE-2016-3627)

  - Fix some format string warnings with possible format     string vulnerability (CVE-2016-4448)

  - More format string warnings with possible format string     vulnerability (CVE-2016-4448)

  - Fix large parse of file from memory (rhbz#862969)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1292 advisory.

    - Heap-based buffer overread in xmlNextChar (CVE-2016-1762)
    - Bug 763071: Heap-buffer-overflow in xmlStrncat <https://bugzilla.gnome.org/show_bug.cgi?id=763071>     (CVE-2016-1834)
    - Bug 757711: Heap-buffer-overflow in xmlFAParsePosCharGroup     <https://bugzilla.gnome.org/show_bug.cgi?id=757711> (CVE-2016-1840)
    - Bug 758588: Heap-based buffer overread in xmlParserPrintFileContextInternal     <https://bugzilla.gnome.org/show_bug.cgi?id=758588> (CVE-2016-1838)
    - Bug 758605: Heap-based buffer overread in xmlDictAddString     <https://bugzilla.gnome.org/show_bug.cgi?id=758605> (CVE-2016-1839)
    - Bug 759398: Heap use-after-free in xmlDictComputeFastKey     <https://bugzilla.gnome.org/show_bug.cgi?id=759398> (CVE-2016-1836)
    - Fix inappropriate fetch of entities content (CVE-2016-4449)
    - Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral (CVE-2016-1837)
    - Heap use-after-free in xmlSAX2AttributeNs (CVE-2016-1835)
    - Heap-based buffer-underreads due to xmlParseName (CVE-2016-4447)
    - Heap-based buffer overread in htmlCurrentChar (CVE-2016-1833)
    - Add missing increments of recursion depth counter to XML parser. (CVE-2016-3705)
    - Avoid building recursive entities (CVE-2016-3627)
    - Fix some format string warnings with possible format string vulnerability (CVE-2016-4448)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libxml2 fixes the following security issues :

  - CVE-2016-2073, CVE-2015-8806, CVE-2016-1839: A     Heap-buffer overread was fixed in libxml2/dict.c     [bsc#963963, bsc#965283, bsc#981114].

  - CVE-2016-4483: Code was added to avoid an out of bound     access when serializing malformed strings [bsc#978395].

  - CVE-2016-1762: Fixed a heap-based buffer overread in     xmlNextChar [bsc#981040].

  - CVE-2016-1834: Fixed a heap-buffer-overflow in     xmlStrncat [bsc#981041].

  - CVE-2016-1833: Fixed a heap-based buffer overread in     htmlCurrentChar [bsc#981108].

  - CVE-2016-1835: Fixed a heap use-after-free in     xmlSAX2AttributeNs [bsc#981109].

  - CVE-2016-1837: Fixed a heap use-after-free in     htmlParsePubidLiteral and htmlParseSystemiteral     [bsc#981111].

  - CVE-2016-1838: Fixed a heap-based buffer overread in     xmlParserPrintFileContextInternal [bsc#981112].

  - CVE-2016-1840: Fixed a heap-buffer-overflow in     xmlFAParsePosCharGroup [bsc#981115].

  - CVE-2016-4447: Fixed a heap-based buffer-underreads due     to xmlParseName [bsc#981548].

  - CVE-2016-4448: Fixed some format string warnings with     possible format string vulnerability [bsc#981549],

  - CVE-2016-4449: Fixed inappropriate fetch of entities     content [bsc#981550].

  - CVE-2016-3705: Fixed missing increment of recursion     counter.

This update was imported from the SUSE:SLE-12:Update update project.

New libxml2 packages are available for Slackware 14.0, 14.1, and
-current to fix security issues.

ID	Name	Product	Family	Severity
198481	RHEL 5 : libxml2 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195433	RHEL 5 : libxml2 (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	critical
121070	Junos OS: Multiple vulnerabilities in libxml2 (JSA10916)	Nessus	Junos Local Security Checks	critical
99492	Fedora 24 : libxml2 (2017-be8574d593)	Nessus	Fedora Local Security Checks	critical
99491	Fedora 25 : libxml2 (2017-a3a47973eb)	Nessus	Fedora Local Security Checks	critical
97893	Tenable Log Correlation Engine (LCE) < 4.8.1 Multiple Vulnerabilities	Nessus	Misc.	critical
97793	Ubuntu 14.04 LTS / 16.04 LTS : libxml2 vulnerabilities (USN-3235-1)	Nessus	Ubuntu Local Security Checks	critical
93154	SUSE SLES11 Security Update : libxml2 (SUSE-SU-2016:1604-1)	Nessus	SuSE Local Security Checks	critical
9441	Mac OS X 10.11.x < 10.11.6 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
9430	Apple TV 9.2.x < 9.2.2 Multiple Vulnerabilities	Nessus Network Monitor	Internet Services	medium
92497	Mac OS X 10.9.5 and 10.10.5 Multiple Vulnerabilities (Security Update 2016-004)	Nessus	MacOS X Local Security Checks	critical
92496	Mac OS X 10.11.x < 10.11.6 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
92494	Apple TV < 9.2.2 Multiple Vulnerabilities	Nessus	Misc.	critical
92411	Apple iTunes < 12.4.2 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	critical
92410	Apple iTunes < 12.4.2 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	critical
92359	Apple iOS < 9.3.3 Multiple Vulnerabilities	Nessus	Mobile Devices	critical
92221	Amazon Linux AMI : libxml2 (ALAS-2016-719)	Nessus	Amazon Linux Local Security Checks	critical
91808	Scientific Linux Security Update : libxml2 on SL6.x, SL7.x i386/x86_64 (20160623)	Nessus	Scientific Linux Local Security Checks	critical
91802	RHEL 6 / 7 : libxml2 (RHSA-2016:1292)	Nessus	Red Hat Local Security Checks	critical
91800	OracleVM 3.3 / 3.4 : libxml2 (OVMSA-2016-0087)	Nessus	OracleVM Local Security Checks	critical
91797	Oracle Linux 6 / 7 : libxml2 (ELSA-2016-1292)	Nessus	Oracle Linux Local Security Checks	critical
91786	CentOS 6 / 7 : libxml2 (CESA-2016:1292)	Nessus	CentOS Local Security Checks	critical
91656	SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2016:1538-1)	Nessus	SuSE Local Security Checks	critical
91639	openSUSE Security Update : libxml2 (openSUSE-2016-733)	Nessus	SuSE Local Security Checks	critical
91353	Slackware 14.0 / 14.1 / current : libxml2 (SSA:2016-148-01)	Nessus	Slackware Local Security Checks	critical

Detections

Analytics

CVE-2016-4448

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical