libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libxml2: Missing validation for external entities in xmlParsePEReference (CVE-2017-7375)

  - The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to     cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value,     related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627. (CVE-2016-4483)

  - libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag     directly indicating that the current document may be read but other files may not be opened, which makes     it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.
    (CVE-2016-9318)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c (CVE-2018-14404)

  - libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails.
    This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is I don't think these issues are     critical enough to warrant a CVE ID ... because an attacker typically can't control when memory     allocations fail. (CVE-2023-45322)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - libxml2: use-after-free in xmlUnlinkNode() in tree.c (CVE-2023-45322)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

According to the versions of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails.
    This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is 'I don't think these issues are     critical enough to warrant a CVE ID ... because an attacker typically can't control when memory     allocations fail.' (CVE-2023-45322)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202402-11 (libxml2: Multiple Vulnerabilities)

  - In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference     and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c. (CVE-2023-28484)

  - An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML     document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic     and memory errors, such as a double free. This behavior occurs because there is an attempt to use the     first byte of an empty string, and any value is possible (not solely the '\0' value). (CVE-2023-29469)

  - libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails.
    This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is I don't think these issues are     critical enough to warrant a CVE ID ... because an attacker typically can't control when memory     allocations fail. (CVE-2023-45322)

  - An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader     interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to     an xmlValidatePopElement use-after-free. (CVE-2024-25062)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails.
    This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is 'I don't think these issues are     critical enough to warrant a CVE ID ... because an attacker typically can't control when memory     allocations fail.' (CVE-2023-45322)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4537-1 advisory.

  - libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails.
    This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is I don't think these issues are     critical enough to warrant a CVE ID ... because an attacker typically can't control when memory     allocations fail. (CVE-2023-45322)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4504-1 advisory.

  - libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails.
    This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is I don't think these issues are     critical enough to warrant a CVE ID ... because an attacker typically can't control when memory     allocations fail. (CVE-2023-45322)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4505-1 advisory.

  - libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails.
    This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is I don't think these issues are     critical enough to warrant a CVE ID ... because an attacker typically can't control when memory     allocations fail. (CVE-2023-45322)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2023:4464-1 advisory.

  - libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails.
    This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is I don't think these issues are     critical enough to warrant a CVE ID ... because an attacker typically can't control when memory     allocations fail. (CVE-2023-45322)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-411 advisory.

  - ** DISPUTED ** libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory     allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is I don't think     these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when     memory allocations fail. (CVE-2023-45322)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libxml2 installed on the remote host is prior to 2.9.1-6.6.44. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1874 advisory.

  - ** DISPUTED ** libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory     allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is I don't think     these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when     memory allocations fail. (CVE-2023-45322)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2321 advisory.

  - ** DISPUTED ** libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory     allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is I don't think     these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when     memory allocations fail. (CVE-2023-45322)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198562	RHEL 7 : libxml2 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198557	RHEL 8 : libxml2 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198489	RHEL 9 : libxml2 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
192380	EulerOS Virtualization 2.11.1 : libxml2 (EulerOS-SA-2024-1403)	Nessus	Huawei Local Security Checks	medium
192369	EulerOS Virtualization 2.11.0 : libxml2 (EulerOS-SA-2024-1431)	Nessus	Huawei Local Security Checks	medium
192070	EulerOS Virtualization 2.10.0 : libxml2 (EulerOS-SA-2024-1384)	Nessus	Huawei Local Security Checks	medium
192057	EulerOS Virtualization 2.10.1 : libxml2 (EulerOS-SA-2024-1363)	Nessus	Huawei Local Security Checks	medium
190354	GLSA-202402-11 : libxml2: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
188533	EulerOS 2.0 SP10 : libxml2 (EulerOS-SA-2024-1090)	Nessus	Huawei Local Security Checks	medium
188491	EulerOS 2.0 SP11 : libxml2 (EulerOS-SA-2023-3278)	Nessus	Huawei Local Security Checks	medium
188400	EulerOS Virtualization 2.9.0 : libxml2 (EulerOS-SA-2024-1016)	Nessus	Huawei Local Security Checks	medium
188371	EulerOS 2.0 SP9 : libxml2 (EulerOS-SA-2023-3311)	Nessus	Huawei Local Security Checks	medium
188365	EulerOS Virtualization 2.9.1 : libxml2 (EulerOS-SA-2024-1042)	Nessus	Huawei Local Security Checks	medium
188349	EulerOS 2.0 SP9 : libxml2 (EulerOS-SA-2023-3343)	Nessus	Huawei Local Security Checks	medium
188348	EulerOS 2.0 SP11 : libxml2 (EulerOS-SA-2023-3250)	Nessus	Huawei Local Security Checks	medium
188091	EulerOS 2.0 SP10 : libxml2 (EulerOS-SA-2024-1066)	Nessus	Huawei Local Security Checks	medium
186232	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libxml2 (SUSE-SU-2023:4537-1)	Nessus	SuSE Local Security Checks	medium
186151	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libxml2 (SUSE-SU-2023:4504-1)	Nessus	SuSE Local Security Checks	medium
186146	SUSE SLES12 Security Update : libxml2 (SUSE-SU-2023:4505-1)	Nessus	SuSE Local Security Checks	medium
185939	openSUSE 15 Security Update : libxml2 (SUSE-SU-2023:4464-1)	Nessus	SuSE Local Security Checks	medium
184430	Amazon Linux 2023 : libxml2, libxml2-devel, libxml2-static (ALAS2023-2023-411)	Nessus	Amazon Linux Local Security Checks	medium
184392	Amazon Linux AMI : libxml2 (ALAS-2023-1874)	Nessus	Amazon Linux Local Security Checks	medium
184283	Amazon Linux 2 : libxml2 (ALAS-2023-2321)	Nessus	Amazon Linux Local Security Checks	medium

Detections

Analytics

CVE-2023-45322

medium

Tenable Plugins

critical

high

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium