Specially crafted xml files could cause a crash or a heap based buffer overlow in libxml2. (CVE-2008-3281 / CVE-2008-3529)

Specially crafted xml files could cause a crash or a heap based buffer overlow in libxml2 (CVE-2008-3281, CVE-2008-3529).

AM 7.0: Sun Java System Access Manager 2005Q4.
Date this patch was last updated by Sun : Nov/03/10

The version of Safari installed on the remote Windows host is earlier than 4.0.  It therefore is potentially affected by numerous issues in the following components :

  - CFNetwork
  - CoreGraphics
  - ImageIO
  - International Components for Unicode
  - libxml
  - Safari
  - Safari Windows Installer
  - WebKit

Sun Management Center 4.0: Patch for Solaris 9.
Date this patch was last updated by Sun : Nov/25/09

Sun Management Center 3.6.1_x86: Patch for Solaris 9.
Date this patch was last updated by Sun : Nov/25/09

The remote host is running a version of Mac OS X 10.4 that does not have Security Update 2009-002 applied.

This security update contains fixes for the following products :

  - Apache
  - ATS
  - BIND
  - CoreGraphics
  - Cscope
  - CUPS
  - Disk Images
  - enscript
  - Flash Player plug-in
  - Help Viewer
  - IPSec
  - Kerberos
  - Launch Services
  - libxml
  - Net-SNMP
  - Network Time
  - OpenSSL
  - QuickDraw Manager
  - Spotlight
  - system_cmds
  - telnet
  - Terminal
  - X11

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.7. 

Mac OS X 10.5.7 contains security fixes for the following products :

  - Apache
  - ATS
  - BIND
  - CFNetwork
  - CoreGraphics
  - Cscope
  - CUPS
  - Disk Images
  - enscript
  - Flash Player plug-in
  - Help Viewer
  - iChat
  - International Components for Unicode
  - IPSec
  - Kerberos
  - Kernel
  - Launch Services
  - libxml
  - Net-SNMP
  - Network Time
  - Networking
  - OpenSSL
  - PHP
  - QuickDraw Manager
  - ruby
  - Safari
  - Spotlight
  - system_cmds
  - telnet
  - Terminal
  - WebKit
  - X11

The remote host is running a version of Sun OpenSSO Enterprise 8.1 earlier than Patch1 Update1. Such versions are potentially affected by a memory corruption vulnerability which an attacker could exploit to crash the affected service, or potentially execute arbitrary code through a specially crafted XML document.

The remote host is running a version of Sun Java System Access Manager 7.1 earlier than Patch 3.  Such versions are potentially affected by multiple issues :

  - A vulnerability related to the CDCServlet component may result in policy advice being presented to the wrong client. (1-66-25968-1)

  - The software amy disclose clear text passwords in debug files when the debug flag is enabled. A local unprivileged user could gain unauthorized access to user identities.

  - A vulnerability may exist when the server processes specially crafted XML documents which may allow an attacker to crash the service or possibly execute arbitrary code.

The version of Safari installed on the remote Windows host is earlier than 3.2.3.  Such versions are potentially affected by several issues :

 - A heap buffer overflow issue in the libxml library when handling long entity names could lead to a crash or arbitrary code execution. (CVE-2008-3529)

 - Multiple input validation issues exist in Safari's handling of 'feed:' URLs, which could be abused to execute arbitrary JavaScript code. (CVE-2009-0162)

 - A memory corruption issue in WebKit's handling of SVGList objects could lead to arbitrary code execution. (CVE-2009-0945) 

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.7.  Mac OS X 10.5.7 contains security fixes for the following products : 

- Apache
- ATS
- BIND
- CFNetwork
- CoreGraphics
-Cscope
- CUPS
- Disk Images
- enscript
- Flash player
- Help Viewer
- iChat
- Internation Components for Unicode
- IPSec
- Kerberos
- Kernel
- Launch Services
- libxml
- Net-SNMP
- Network Time
- Networking
- OpenSSL
- PHP
- QuickDraw Manager
- ruby
- Safari
- Spotlight
- system_cmds
- telnet
- WebKit
- X11
- Terminal

The version of Safari installed on the remote Windows host is earlier than 3.2.3.  Such versions are potentially affected by several issues :

 - A heap buffer overflow issue in the libxml library when handling long entity names could lead to a crash or arbitrary code execution. (CVE-2008-3529)

 - Multiple input validation issues exist in Safari's handling of 'feed:' URLs, which could be abused to execute arbitrary JavaScript code. (CVE-2009-0162)

 - A memory corruption issue in WebKit's handling of SVGList objects could lead to arbitrary code execution. (CVE-2009-0945)

ID	Name	Product	Family	Published	Updated	Severity
34207	SuSE 10 Security Update : libxml2 (ZYPP Patch Number 5583)	Nessus	SuSE Local Security Checks	9/15/2008	1/14/2021	critical
34208	openSUSE 10 Security Update : libxml2 (libxml2-5586)	Nessus	SuSE Local Security Checks	9/15/2008	1/14/2021	critical
37533	Solaris 9 (sparc) : 120954-12	Nessus	Solaris Local Security Checks	4/23/2009	1/14/2021	critical
39339	Safari < 4.0 Multiple Vulnerabilities	Nessus	Windows	6/9/2009	7/27/2018	high
67167	Solaris 9 (sparc) : 127681-07	Nessus	Solaris Local Security Checks	7/3/2013	1/14/2021	critical
67169	Solaris 9 (x86) : 123922-11	Nessus	Solaris Local Security Checks	7/3/2013	1/14/2021	critical
38743	Mac OS X Multiple Vulnerabilities (Security Update 2009-002)	Nessus	MacOS X Local Security Checks	5/13/2009	5/28/2024	critical
38744	Mac OS X 10.5.x < 10.5.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	5/13/2009	5/28/2024	critical
5134	Sun OpenSSO Enterprise 8.0 < Patch1 Update1 Memory Corruption	Nessus Network Monitor	Web Servers	8/13/2009	3/6/2019	medium
5133	Sun Java System Access Manager 7.1 < Patch 3 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	8/13/2009	3/6/2019	medium
5024	Safari < 3.2.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	8/18/2004	3/6/2019	high
5023	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Nessus Network Monitor	Generic	8/18/2004	3/6/2019	critical
800998	Safari < 3.2.3 Multiple Vulnerabilities	Log Correlation Engine	Web Clients			high
800792	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection			high

Detections

Analytics

Plugins Search

critical

critical

critical

high

critical

critical

critical

critical

medium

medium

high

critical

high

high