In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2025:0024-1 advisory.

    - CVE-2024-40896: Fixed a XML external entity vulnerability related to libxml2 (boo#1234820)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7215-1 advisory.

    Xisco Fauli discovered that libxml2 incorrectly handled custom SAX handlers. A remote attacker could     possibly use this issue to perform XML External Entity (XXE) attacks.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-9f3765a04b advisory.

    Update to 2.12.9

    Fixes CVE-2024-40896

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-867a14de12 advisory.

    Update to 2.12.9

    Fixes CVE-2024-40896.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the libxml2 package has been released.

The version of libxml2 installed on the remote host is prior to 2.11.9 / 2.13.3. It is, therefore, affected by a vulnerability as referenced in the SSA:2024-206-02 advisory.

    New libxml2 packages are available for Slackware XXX 15.0 and -current to fix a security issue.

Tenable has extracted the preceding description block directly from the libxml2 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
214570	openSUSE 15 Security Update : qt6-webengine (openSUSE-SU-2025:0024-1)	Nessus	SuSE Local Security Checks	critical
214329	Ubuntu 24.10 : libxml2 vulnerability (USN-7215-1)	Nessus	Ubuntu Local Security Checks	critical
213446	Fedora 40 : libxml2 (2024-9f3765a04b)	Nessus	Fedora Local Security Checks	critical
213402	Fedora 41 : libxml2 (2024-867a14de12)	Nessus	Fedora Local Security Checks	critical
206725	Photon OS 5.0: Libxml2 PHSA-2024-5.0-0354	Nessus	PhotonOS Local Security Checks	critical
204680	Slackware Linux 15.0 / current libxml2 Vulnerability (SSA:2024-206-02)	Nessus	Slackware Local Security Checks	critical

Detections

Analytics

CVE-2024-40896

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical