Detections
Analytics
GLSA-200411-05 : libxml2: Remotely exploitable buffer overflow
critical Nessus Plugin ID 15610
Synopsis
The remote Gentoo host is missing one or more security-related patches.Description
The remote host is affected by the vulnerability described in GLSA-200411-05 (libxml2: Remotely exploitable buffer overflow)Multiple buffer overflows have been detected in the nanoftp and nanohttp modules. These modules are responsible for parsing URLs with ftp information, and resolving names via DNS.
Impact :
An attacker could exploit an application that uses libxml2 by forcing it to parse a specially crafted XML file, potentially causing remote execution of arbitrary code.
Workaround :
There is no known workaround at this time.
Solution
All libxml2 users should upgrade to the latest version:# emerge --sync # emerge --ask --oneshot --verbose '>=dev-libs/libxml2-2.6.15'
See Also
https://www.securityfocus.com/archive/1/379383
Plugin Details
Severity: Critical
ID: 15610
File Name: gentoo_GLSA-200411-05.nasl
Version: 1.20
Type: local
Family: Gentoo Local Security Checks
Published: 11/3/2004
Updated: 1/6/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.6
CVSS v2
Risk Factor: Critical
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:gentoo:linux:libxml2, cpe:/o:gentoo:linux
Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list
Patch Publication Date: 11/2/2004
Reference Information
CVE: CVE-2004-0989
GLSA: 200411-05