This is an urgent security fix for a bug newly introduced in libxml2-2.7.x leading to CPU and memory exhaustion. See upstream bug report for further details:
https://bugzilla.gnome.org/show_bug.cgi?id=554660

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Safari installed on the remote Windows host is earlier than 4.0.  It therefore is potentially affected by numerous issues in the following components :

  - CFNetwork
  - CoreGraphics
  - ImageIO
  - International Components for Unicode
  - libxml
  - Safari
  - Safari Windows Installer
  - WebKit

The version of Apple Safari installed on the remote Mac OS X host is earlier than 4.0.  As such, it is potentially affected by numerous issues in the following components :

  - CFNetwork
  - libxml
  - Safari
  - WebKit

libxml2 version 2.7.0 and 2.7.1 did not properly handle predefined entities definitions in entities, which allowed context-dependent attackers to cause a denial of service (memory consumption and application crash) via certain XML documents (CVE-2008-4409).

The updated packages have been patched to prevent this issue.

The remote host is affected by the vulnerability described in GLSA-200812-06 (libxml2: Multiple vulnerabilities)

    Multiple vulnerabilities were reported in libxml2:
    Andreas Solberg reported that libxml2 does not properly detect     recursion during entity expansion in an attribute value     (CVE-2008-3281).
    A heap-based buffer overflow has been reported in the     xmlParseAttValueComplex() function in parser.c (CVE-2008-3529).
    Christian Weiske reported that predefined entity definitions in     entities are not properly handled (CVE-2008-4409).
    Drew Yao of Apple Product Security reported an integer overflow in the     xmlBufferResize() function that can lead to an infinite loop     (CVE-2008-4225).
    Drew Yao of Apple Product Security reported an integer overflow in the     xmlSAX2Characters() function leading to a memory corruption     (CVE-2008-4226).
  Impact :

    A remote attacker could entice a user or automated system to open a     specially crafted XML document with an application using libxml2,     possibly resulting in the exeution of arbitrary code or a high CPU and     memory consumption.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Published	Updated	Severity
34341	Fedora 9 : libxml2-2.7.1-2.fc9 (2008-8575)	Nessus	Fedora Local Security Checks	10/6/2008	1/11/2021	medium
39339	Safari < 4.0 Multiple Vulnerabilities	Nessus	Windows	6/9/2009	7/27/2018	high
34342	Fedora 8 : libxml2-2.7.1-2.fc8 (2008-8582)	Nessus	Fedora Local Security Checks	10/6/2008	1/11/2021	medium
39338	Mac OS X : Apple Safari < 4.0	Nessus	MacOS X Local Security Checks	6/9/2009	7/14/2018	high
36844	Mandriva Linux Security Advisory : libxml2 (MDVSA-2008:212)	Nessus	Mandriva Local Security Checks	4/23/2009	1/6/2021	medium
35023	GLSA-200812-06 : libxml2: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	12/3/2008	1/6/2021	critical

Detections

Analytics

Plugins Search

medium

high

medium

high

medium

critical