The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3665-1 advisory.

  - Possible cross-site scripting vulnerability in libxml after commit 960f0e2. (CVE-2016-3709)

  - In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference     and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c. (CVE-2023-28484)

  - An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML     document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic     and memory errors, such as a double free. This behavior occurs because there is an attempt to use the     first byte of an empty string, and any value is possible (not solely the '\0' value). (CVE-2023-29469)

  - ** DISPUTED ** Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the     xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial     of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does     not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input.
    (CVE-2023-39615)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5391 advisory.

  - The libxml2 project reports: Hashing of empty dict strings isn't deterministic Fix null deref in     xmlSchemaFixupComplexType (CVE-2023-28484, CVE-2023-29469)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libxml2 installed on the remote host is prior to 2.9.1-6.6.42. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1743 advisory.

    parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the     xmlParserHandlePEReference function in the case of a '%' character in a DTD name. (CVE-2017-16931)

    GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at     libxml2/entities.c. The issue has been fixed in commit 50f06b3e. (CVE-2020-24977)

    There's a flaw in libxml2's xmllint. An attacker who is able to submit a crafted file to be processed by     xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity,     and availability. (CVE-2021-3516)

    There is a flaw in the xml entity encoding functionality of libxml2. An attacker who is able to supply a     crafted file to be processed by an application linked with the affected functionality of libxml2 could     trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with     some potential impact to confidentiality and integrity if an attacker is able to use memory information to     further exploit the application. (CVE-2021-3517)

    There's a flaw in libxml2. An attacker who is able to submit a crafted file to be processed by an     application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to     confidentiality, integrity, and availability. (CVE-2021-3518)

    A NULL pointer dereference flaw was found in libxml2, where it did not propagate errors while parsing XML     mixed content. This flaw causes the application to crash if an untrusted XML document is parsed in     recovery mode and post validated. The highest threat from this vulnerability is to system availability.
    (CVE-2021-3537)

    A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing     protection mechanisms and leading to denial of service. (CVE-2021-3541)

    valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. (CVE-2022-23308)

    A flaw was found in the libxml2 library in functions used to manipulate the xmlBuf and the xmlBuffer     types. A substantial input causes values to calculate buffer sizes to overflow, resulting in an out-of-     bounds write. (CVE-2022-29824)

    An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the     XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to     access an array at a negative 2GB offset, typically leading to a segmentation fault. (CVE-2022-40303)

    An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a     hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be     provoked. (CVE-2022-40304)

    A NULL pointer dereference exists when parsing (invalid) XML schemas in libxml2     xmlSchemaCheckCOSSTDerivedOK (CVE-2023-28484)

    libxml2 Hashing of empty dict strings isn't deterministic. When hashing empty strings which aren't null-     terminated, xmlDictComputeFastKey could produce inconsistent results. This could lead to various logic or     memory errors, including double frees. (CVE-2023-29469)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of MySQL Cluster installed on the remote host are affected by a vulnerability as referenced in the October 2023 CPU advisory.

  - Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General (libxml2)).     Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Cluster.     Successful attacks require human interaction from a person other than the attacker. Successful attacks     of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of MySQL Cluster. (CVE-2023-28484)

  - Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General (curl)).     Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Cluster.     Successful attacks of this vulnerability can result in takeover of MySQL Cluster. (CVE-2023-38545)

  - Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General (Kerberos)).     Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability     allows low privileged attacker with network access via multiple protocols to compromise MySQL Cluster.     Successful attacks of this vulnerability can result in takeover of MySQL Cluster.(CVE-2022-42898)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	Name	Product	Family	Published	Updated	Severity
181575	SUSE SLES12 Security Update : libxml2 (SUSE-SU-2023:3665-1)	Nessus	SuSE Local Security Checks	9/19/2023	9/19/2023	medium
174607	Debian DSA-5391-1 : libxml2 - security update	Nessus	Debian Local Security Checks	4/21/2023	10/23/2023	medium
175091	Amazon Linux AMI : libxml2 (ALAS-2023-1743)	Nessus	Amazon Linux Local Security Checks	5/4/2023	12/11/2024	critical
183437	Oracle MySQL Cluster 8.x < 8.2.0 (Oct 2023 CPU)	Nessus	Databases	10/19/2023	1/23/2024	critical
502899	Siemens SCALANCE W700 NULL Pointer Dereference (CVE-2023-28484)	Tenable OT Security	Tenable.ot	2/24/2025	2/25/2025	medium

Detections

Analytics

Plugins Search

medium

medium

critical

critical

medium