このlibxml2の更新では、3つのセキュリティ問題を修正します。

  - CVE-2017-15412：リモートの攻撃者がDoSまたはRCEを引き起こす可能性のあるXPath拡張関数を呼び出す場合、メモリ解放後使用（use-after-free）を防止します（bsc#1077993）

  - CVE-2016-5131：libxml2のメモリ解放後使用の脆弱性により、リモートの攻撃者が、XPointer range-to関数に関連するベクトルを介してサービス拒否を引き起こしたり、詳細不明のその他の影響を与えたりすることが可能でした。（bsc#1078813）

  - CVE-2017-5130：関数xmlMemoryStrdup()の潜在的なリモートバッファオーバーフローが修正されました（bsc#1078806）

この更新はSUSEからインポートされました：SLE-12-SP2：更新プロジェクトを更新します。

リモートのmacOSまたはMac OS XホストにインストールされているGoogle Chromeのバージョンは62.0.32より前です。したがって、2017年10月17日のChrome Stableチャンネルの更新プログラムリリースノートに記載されているとおり、複数の脆弱性の影響を受けます。詳細については、上流のアドバイザリを参照してください：

リモートホストでMac OS X 10.11.6またはMac OS X 10.12.6が実行されており、セキュリティ更新プログラムがありません。したがって、以下のコンポーネントに影響を与える複数の脆弱性の影響を受けます。 - 802.1X - apache - AppleScript - ATS - Audio - CFString - CoreText - curl - Dictionary Widget - file - Fonts - fsck_msdos - HFS - Heimdal - HelpViewer - ImageIO - Kernel - libarchive - Open Scripting Architecture - PCRE - Postfix - Quick Look - QuickTime - Remote Management - Sandbox - StreamingZip - tcpdump - Wi-Fi

This update to Chromium 62.0.3202.75 fixes the following security issues :

  - CVE-2017-5124: UXSS with MHTML

  - CVE-2017-5125: Heap overflow in Skia

  - CVE-2017-5126: Use after free in PDFium 

  - CVE-2017-5127: Use after free in PDFium

  - CVE-2017-5128: Heap overflow in WebGL

  - CVE-2017-5129: Use after free in WebAudio 

  - CVE-2017-5132: Incorrect stack manipulation in     WebAssembly.

  - CVE-2017-5130: Heap overflow in libxml2

  - CVE-2017-5131: Out of bounds write in Skia 

  - CVE-2017-5133: Out of bounds write in Skia 

  - CVE-2017-15386: UI spoofing in Blink

  - CVE-2017-15387: Content security bypass

  - CVE-2017-15388: Out of bounds read in Skia

  - CVE-2017-15389: URL spoofing in OmniBox

  - CVE-2017-15390: URL spoofing in OmniBox 

  - CVE-2017-15391: Extension limitation bypass in     Extensions.

  - CVE-2017-15392: Incorrect registry key handling in     PlatformIntegration

  - CVE-2017-15393: Referrer leak in Devtools

  - CVE-2017-15394: URL spoofing in extensions UI

  - CVE-2017-15395: NULL pointer dereference in ImageCapture

  - CVE-2017-15396: Stack overflow in V8

The remote host is affected by the vulnerability described in GLSA-201710-24 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the referenced CVE identifiers and Google Chrome       Releases for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, bypass       content security controls, or conduct URL spoofing.
  Workaround :

    There is no known workaround at this time.

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An integer overflow in xmlmemory.c in libxml2 before     2.9.5, as used in Google Chrome prior to 62.0.3202.62     and other products, allowed a remote attacker to     potentially exploit heap corruption via a crafted XML     file.(CVE-2017-5130)

  - libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a     heap-based buffer over-read in the     xmlDictComputeFastKey function in dict.c. This     vulnerability causes programs that use libxml2, such as     PHP, to crash. (CVE-2017-9049)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-15398, CVE-2017-15399

----

Security fix for CVE-2017-15386 CVE-2017-15387 CVE-2017-15388 CVE-2017-15389 CVE-2017-15390 CVE-2017-15391 CVE-2017-15392 CVE-2017-15393 CVE-2017-15394 CVE-2017-15395 CVE-2017-5124 CVE-2017-5125 CVE-2017-5126 CVE-2017-5127.

Build switched to use gtk3.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle HTTP Server installed on the remote host is affected by the following vulnerabilities as referenced in the April 2020 CPU advisory:

  - An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Oracle HTTP Server's Web Listener     component, allows a remote attacker to potentially exploit heap corruption via a crafted XML file.
    (CVE-2017-5130)

  - An easily exploitable vulnerability in Oracle HTTP Server's Web Listener component affecting the supported     version 11.1.1.9.0. An unauthenticated, remote attacker with network access via HTTP can exploit this to     compromise Oracle HTTP Server, resulting in unauthorized update, insert or delete access to some of Oracle     HTTP Server accessible data as well as unauthorized read access to a subset of Oracle HTTP Server     accessible data. (CVE-2020-2952)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apple iOS running on the mobile device is prior to 11.0.1. It is, therefore, affected by multiple vulnerabilities as described in the HT208143 security advisory.

ID	Name	Product	Family	Published	Updated	Severity
106741	openSUSEセキュリティ更新プログラム：libxml2（openSUSE-2018-154）	Nessus	SuSE Local Security Checks	2/12/2018	1/19/2021	high
103934	Google Chrome < 62.0.3202.62の複数の脆弱性（macOS）	Nessus	MacOS X Local Security Checks	10/18/2017	11/12/2019	high
104379	macOSおよびMac OS Xの複数の脆弱性（セキュリティ更新プログラム2017-001および2017-004）	Nessus	MacOS X Local Security Checks	11/3/2017	5/28/2024	critical
104244	openSUSE Security Update : chromium (openSUSE-2017-1221)	Nessus	SuSE Local Security Checks	10/30/2017	1/19/2021	high
104067	GLSA-201710-24 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	10/23/2017	1/11/2021	high
108475	EulerOS 2.0 SP2 : libxml2 (EulerOS-SA-2018-1071)	Nessus	Huawei Local Security Checks	3/20/2018	1/6/2021	high
106002	Fedora 27 : chromium (2017-f2f3fa09e3)	Nessus	Fedora Local Security Checks	1/15/2018	1/6/2021	critical
135677	Oracle Fusion Middleware Oracle HTTP Server (Apr 2020 CPU)	Nessus	Web Servers	4/16/2020	6/19/2024	high
700542	Apple iOS < 11.0.1 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	4/17/2019	4/17/2019	critical

Detections

Analytics

Plugins Search

high

high

critical

high

high

high

critical

high

critical