parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libxml2: Missing validation for external entities in xmlParsePEReference (CVE-2017-7375)

  - The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to     cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value,     related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627. (CVE-2016-4483)

  - libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag     directly indicating that the current document may be read but other files may not be opened, which makes     it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.
    (CVE-2016-9318)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libxml2: Use after free via namespace node in XPointer ranges (CVE-2016-4658)

  - libxml2: Missing validation for external entities in xmlParsePEReference (CVE-2017-7375)

  - libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer     uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to     cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read     arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be     argued that because libxml2 already provides the ability to disable external entity expansion, the     responsibility for resolving this issue lies with application developers; according to this argument, this     entry should be REJECTed and each affected application would need its own CVE. (CVE-2013-0339)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libxml2: Use after free via namespace node in XPointer ranges (CVE-2016-4658)

  - libxml2: Missing validation for external entities in xmlParsePEReference (CVE-2017-7375)

  - libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer     uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to     cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read     arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be     argued that because libxml2 already provides the ability to disable external entity expansion, the     responsibility for resolving this issue lies with application developers; according to this argument, this     entry should be REJECTed and each affected application would need its own CVE. (CVE-2013-0339)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

The version of libxml2 installed on the remote host is prior to 2.9.1-6.6.42. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1743 advisory.

    parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the     xmlParserHandlePEReference function in the case of a '%' character in a DTD name. (CVE-2017-16931)

    GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at     libxml2/entities.c. The issue has been fixed in commit 50f06b3e. (CVE-2020-24977)

    There's a flaw in libxml2's xmllint. An attacker who is able to submit a crafted file to be processed by     xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity,     and availability. (CVE-2021-3516)

    There is a flaw in the xml entity encoding functionality of libxml2. An attacker who is able to supply a     crafted file to be processed by an application linked with the affected functionality of libxml2 could     trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with     some potential impact to confidentiality and integrity if an attacker is able to use memory information to     further exploit the application. (CVE-2021-3517)

    There's a flaw in libxml2. An attacker who is able to submit a crafted file to be processed by an     application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to     confidentiality, integrity, and availability. (CVE-2021-3518)

    A NULL pointer dereference flaw was found in libxml2, where it did not propagate errors while parsing XML     mixed content. This flaw causes the application to crash if an untrusted XML document is parsed in     recovery mode and post validated. The highest threat from this vulnerability is to system availability.
    (CVE-2021-3537)

    A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing     protection mechanisms and leading to denial of service. (CVE-2021-3541)

    valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. (CVE-2022-23308)

    A flaw was found in the libxml2 library in functions used to manipulate the xmlBuf and the xmlBuffer     types. A substantial input causes values to calculate buffer sizes to overflow, resulting in an out-of-     bounds write. (CVE-2022-29824)

    An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the     XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to     access an array at a negative 2GB offset, typically leading to a segmentation fault. (CVE-2022-40303)

    An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a     hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be     provoked. (CVE-2022-40304)

    A NULL pointer dereference exists when parsing (invalid) XML schemas in libxml2     xmlSchemaCheckCOSSTDerivedOK (CVE-2023-28484)

    libxml2 Hashing of empty dict strings isn't deterministic. When hashing empty strings which aren't null-     terminated, xmlDictComputeFastKey could produce inconsistent results. This could lead to various logic or     memory errors, including double frees. (CVE-2023-29469)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document. (CVE-2016-4658)

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name. (CVE-2017-16931)

According to the versions of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A remote code execution vulnerability in libxml2 could     enable an attacker using a specially crafted file to     execute arbitrary code within the context of an     unprivileged process. This issue is rated as High due     to the possibility of remote code execution in an     application that uses this library. Product: Android.
    Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1,     7.1.2. Android ID: A-37104170.(CVE-2017-0663)

  - parser.c in libxml2 before 2.9.5 mishandles     parameter-entity references because the NEXTL macro     calls the xmlParserHandlePEReference function in the     case of a '%' character in a DTD name.(CVE-2017-16931)

  - parser.c in libxml2 before 2.9.5 does not prevent     infinite recursion in parameter     entities.(CVE-2017-16932)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Use-after-free vulnerability in libxml2 through 2.9.4,     as used in Google Chrome before 52.0.2743.82, allows     remote attackers to cause a denial of service or     possibly have unspecified other impact via vectors     related to the XPointer range-to     function.(CVE-2016-5131)

  - parser.c in libxml2 before 2.9.5 mishandles     parameter-entity references because the NEXTL macro     calls the xmlParserHandlePEReference function in the     case of a '%' character in a DTD name.(CVE-2017-16931)

  - parser.c in libxml2 before 2.9.5 does not prevent     infinite recursion in parameter     entities.)CVE-2017-16932)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Use-after-free vulnerability in libxml2 through 2.9.4,     as used in Google Chrome before 52.0.2743.82, allows     remote attackers to cause a denial of service or     possibly have unspecified other impact via vectors     related to the XPointer range-to     function.(CVE-2016-5131)

  - parser.c in libxml2 before 2.9.5 mishandles     parameter-entity references because the NEXTL macro     calls the xmlParserHandlePEReference function in the     case of a '%' character in a DTD name.(CVE-2017-16931)

  - parser.c in libxml2 before 2.9.5 does not prevent     infinite recursion in parameter     entities.)CVE-2017-16932)

  - A flaw in libxml2 allows remote XML entity inclusion     with default parser flags (i.e., when the caller did     not request entity substitution, DTD validation,     external DTD subset loading, or default DTD     attributes). Depending on the context, this may expose     a higher-risk attack surface in libxml2 not usually     reachable with default parser flags, and expose content     from local files, HTTP, or FTP servers (which might be     otherwise unreachable).(CVE-2017-7375)

  - Buffer overflow in libxml2 allows remote attackers to     execute arbitrary code by leveraging an incorrect limit     for port values when handling redirects.(CVE-2017-7376)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2017-16931 parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.

CVE-2017-16932 parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.

For Debian 7 'Wheezy', these problems have been fixed in version 2.8.0+dfsg1-7+wheezy11.

We recommend that you upgrade your libxml2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198562	RHEL 7 : libxml2 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198542	RHEL 6 : libxml2 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198481	RHEL 5 : libxml2 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195433	RHEL 5 : libxml2 (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
195373	RHEL 7 : libxml2 (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
195344	RHEL 6 : libxml2 (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	critical
175091	Amazon Linux AMI : libxml2 (ALAS-2023-1743)	Nessus	Amazon Linux Local Security Checks	critical
129559	Amazon Linux 2 : libxml2 (ALAS-2019-1301)	Nessus	Amazon Linux Local Security Checks	critical
117567	EulerOS Virtualization 2.5.0 : libxml2 (EulerOS-SA-2018-1258)	Nessus	Huawei Local Security Checks	critical
117566	EulerOS Virtualization 2.5.1 : libxml2 (EulerOS-SA-2018-1257)	Nessus	Huawei Local Security Checks	critical
110732	EulerOS 2.0 SP3 : libxml2 (EulerOS-SA-2018-1156)	Nessus	Huawei Local Security Checks	critical
109487	EulerOS 2.0 SP2 : libxml2 (EulerOS-SA-2018-1089)	Nessus	Huawei Local Security Checks	critical
109486	EulerOS 2.0 SP1 : libxml2 (EulerOS-SA-2018-1088)	Nessus	Huawei Local Security Checks	critical
104936	Debian DLA-1194-1 : libxml2 security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2017-16931

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical