Vulnerabilities > CVE-2015-7942 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products

047910
CVSS 6.8 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL

Summary

The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941.

Vulnerable Configurations

Part Description Count
Application
Hp
2
Application
Xmlsoft
1
OS
Debian
2
OS
Apple
282
OS
Canonical
4

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2015-959.NASL
    description - update to 2.9.3 - full changelog: http://www.xmlsoft.org/news.html - fixed CVEs: CVE-2015-8242, CVE-2015-7500, CVE-2015-7499, CVE-2015-5312, CVE-2015-7497, CVE-2015-7498, CVE-2015-8035, CVE-2015-7942, CVE-2015-1819, CVE-2015-7941, CVE-2014-3660, CVE-2014-0191, CVE-2015-8241, CVE-2015-8317 - fixed bugs: [bsc#928193], [bsc#951734], [bsc#951735], [bsc#954429], [bsc#956018], [bsc#956021], [bsc#956260], [bsc#957105], [bsc#957106], [bsc#957107], [bsc#957109], [bsc#957110]
    last seen2020-06-05
    modified2015-12-29
    plugin id87631
    published2015-12-29
    reporterThis script is Copyright (C) 2015-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/87631
    titleopenSUSE Security Update : libxml2 (openSUSE-2015-959)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2015-959.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(87631);
      script_version("2.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2014-0191", "CVE-2014-3660", "CVE-2015-1819", "CVE-2015-5312", "CVE-2015-7497", "CVE-2015-7498", "CVE-2015-7499", "CVE-2015-7500", "CVE-2015-7941", "CVE-2015-7942", "CVE-2015-8035", "CVE-2015-8241", "CVE-2015-8242", "CVE-2015-8317");
    
      script_name(english:"openSUSE Security Update : libxml2 (openSUSE-2015-959)");
      script_summary(english:"Check for the openSUSE-2015-959 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "  - update to 2.9.3
    
      - full changelog: http://www.xmlsoft.org/news.html
    
      - fixed CVEs: CVE-2015-8242, CVE-2015-7500, CVE-2015-7499,
        CVE-2015-5312, CVE-2015-7497, CVE-2015-7498,
        CVE-2015-8035, CVE-2015-7942, CVE-2015-1819,
        CVE-2015-7941, CVE-2014-3660, CVE-2014-0191,
        CVE-2015-8241, CVE-2015-8317
    
      - fixed bugs: [bsc#928193], [bsc#951734], [bsc#951735],
        [bsc#954429], [bsc#956018], [bsc#956021], [bsc#956260],
        [bsc#957105], [bsc#957106], [bsc#957107], [bsc#957109],
        [bsc#957110]"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.xmlsoft.org/news.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=928193"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=951734"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=951735"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=954429"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=956018"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=956021"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=956260"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=957105"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=957106"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=957107"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=957109"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=957110"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected libxml2 packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxml2-2");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxml2-2-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxml2-2-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxml2-2-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxml2-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxml2-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxml2-devel-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxml2-tools");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxml2-tools-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-libxml2");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-libxml2-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-libxml2-debugsource");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.2");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2015/12/26");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/12/29");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE13\.1|SUSE13\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "13.1 / 13.2", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE13.1", reference:"libxml2-2-2.9.3-2.19.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"libxml2-2-debuginfo-2.9.3-2.19.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"libxml2-debugsource-2.9.3-2.19.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"libxml2-devel-2.9.3-2.19.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"libxml2-tools-2.9.3-2.19.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"libxml2-tools-debuginfo-2.9.3-2.19.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"python-libxml2-2.9.3-2.19.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"python-libxml2-debuginfo-2.9.3-2.19.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", reference:"python-libxml2-debugsource-2.9.3-2.19.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"libxml2-2-32bit-2.9.3-2.19.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"libxml2-2-debuginfo-32bit-2.9.3-2.19.1") ) flag++;
    if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"libxml2-devel-32bit-2.9.3-2.19.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"libxml2-2-2.9.3-7.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"libxml2-2-debuginfo-2.9.3-7.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"libxml2-debugsource-2.9.3-7.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"libxml2-devel-2.9.3-7.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"libxml2-tools-2.9.3-7.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"libxml2-tools-debuginfo-2.9.3-7.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"python-libxml2-2.9.3-7.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"python-libxml2-debuginfo-2.9.3-7.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"python-libxml2-debugsource-2.9.3-7.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", cpu:"x86_64", reference:"libxml2-2-32bit-2.9.3-7.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", cpu:"x86_64", reference:"libxml2-2-debuginfo-32bit-2.9.3-7.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", cpu:"x86_64", reference:"libxml2-devel-32bit-2.9.3-7.4.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxml2-2 / libxml2-2-32bit / libxml2-2-debuginfo / etc");
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-189A7BF68C.NASL
    descriptionUpdate to 2.9.3 which fixes various CVE
    last seen2020-06-05
    modified2016-03-04
    plugin id89484
    published2016-03-04
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/89484
    titleFedora 23 : mingw-libxml2-2.9.3-1.fc23 (2016-189a7bf68c)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2016-189a7bf68c.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(89484);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2015-7941", "CVE-2015-7942", "CVE-2015-8035");
      script_xref(name:"FEDORA", value:"2016-189a7bf68c");
    
      script_name(english:"Fedora 23 : mingw-libxml2-2.9.3-1.fc23 (2016-189a7bf68c)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Update to 2.9.3 which fixes various CVE's
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1262853"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1274225"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1276299"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1277149"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1281952"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2016-February/177341.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?e4706f27"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected mingw-libxml2 package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mingw-libxml2");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:23");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2016/02/16");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/03/04");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^23([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 23.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC23", reference:"mingw-libxml2-2.9.3-1.fc23")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mingw-libxml2");
    }
    
  • NASL familyAIX Local Security Checks
    NASL idAIX_IV80586.NASL
    descriptionThe remote AIX host has a version of libxml2 installed that is affected by the following vulnerabilities : - A heap-based buffer overflow condition exists in the xmlParseEntityDecl() and xmlParseConditionalSections() functions within file parser.c due to a failure to properly stop parsing invalid input. An unauthenticated, remote attacker can exploit this, via specially crafted XML data, to cause a denial of service condition or potentially disclose sensitive memory contents. (CVE-2015-7941) - A heap-based buffer overflow condition exists in the xmlParseConditionalSections() function within file parser.c due to not properly skipping intermediary entities. An unauthenticated, remote attacker can exploit this, via specially crafted XML data, to cause a denial of service condition. (CVE-2015-7942) - A buffer overflow condition exists in the xmlNextChar() function due to improper bounds checking. A local attacker can exploit this, via a malformed XML file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2015-8241)
    last seen2020-06-01
    modified2020-06-02
    plugin id88882
    published2016-02-23
    reporterThis script is Copyright (C) 2016-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/88882
    titleAIX 7.1 TL 3 : libxml2 (IV80586)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(88882);
      script_version("2.10");
      script_cvs_date("Date: 2018/07/17 12:00:06");
    
      script_cve_id(
        "CVE-2015-7941",
        "CVE-2015-7942",
        "CVE-2015-8241"
      );
      script_bugtraq_id(
        74241,
        77621,
        79507
      );
    
      script_name(english:"AIX 7.1 TL 3 : libxml2 (IV80586)");
      script_summary(english:"Checks the version of the libxml2 packages and iFixes.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote AIX host has a version of libxml2 installed that is
    affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote AIX host has a version of libxml2 installed that is
    affected by the following vulnerabilities :
    
      - A heap-based buffer overflow condition exists in the
        xmlParseEntityDecl() and xmlParseConditionalSections()
        functions within file parser.c due to a failure to
        properly stop parsing invalid input. An unauthenticated,
        remote attacker can exploit this, via specially crafted
        XML data, to cause a denial of service condition or
        potentially disclose sensitive memory contents.
        (CVE-2015-7941)
    
      - A heap-based buffer overflow condition exists in the
        xmlParseConditionalSections() function within file
        parser.c due to not properly skipping intermediary
        entities. An unauthenticated, remote attacker can
        exploit this, via specially crafted XML data, to cause a
        denial of service condition. (CVE-2015-7942)
    
      - A buffer overflow condition exists in the xmlNextChar()
        function due to improper bounds checking. A local
        attacker can exploit this, via a malformed XML file, to
        cause a denial of service condition or the execution of
        arbitrary code. (CVE-2015-8241)");
      script_set_attribute(attribute:"see_also", value:"http://aix.software.ibm.com/aix/efixes/security/libxml2_advisory2.asc");
      script_set_attribute(attribute:"solution", value:
    "Install the appropriate interim fix.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:ND");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2015/02/22");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/02/22");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/02/23");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:ibm:aix:7.1");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"AIX Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2016-2018 Tenable Network Security, Inc.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/AIX/lslpp", "Host/local_checks_enabled", "Host/AIX/version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("aix.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    oslevel = get_kb_item("Host/AIX/version");
    if (isnull(oslevel)) audit(AUDIT_UNKNOWN_APP_VER, "AIX");
    if ( oslevel != "AIX-7.1" )
    {
      oslevel = ereg_replace(string:oslevel, pattern:"-", replace:" ");
      audit(AUDIT_OS_NOT, "AIX 7.1", oslevel);
    }
    
    oslevelcomplete = chomp(get_kb_item("Host/AIX/oslevelsp"));
    if (isnull(oslevelcomplete)) audit(AUDIT_UNKNOWN_APP_VER, "AIX");
    oslevelparts = split(oslevelcomplete, sep:'-', keep:0);
    if ( max_index(oslevelparts) != 4 ) audit(AUDIT_UNKNOWN_APP_VER, "AIX");
    ml = oslevelparts[1];
    version_report = "AIX " + oslevel + " ML " + ml;
    if ( ml != "03" && ml != "04" )
    {
      audit(AUDIT_OS_NOT, "ML 03/04", version_report);
    }
    
    if ( ! get_kb_item("Host/AIX/lslpp") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    if ( get_kb_item("Host/AIX/emgr_failure" ) ) exit(0, "This AIX package check is disabled because : "+get_kb_item("Host/AIX/emgr_failure") );
    
    flag = 0;
    
    if (aix_check_ifix(release:"7.1", ml:"03", patch:"IV80586s1a", package:"bos.rte.control", minfilesetver:"7.1.3.0", maxfilesetver:"7.1.3.46") < 0) flag++;
    if (aix_check_ifix(release:"7.1", ml:"04", patch:"IV80586s1a", package:"bos.rte.control", minfilesetver:"7.1.4.0", maxfilesetver:"7.1.4.0") < 0) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : aix_report_get()
      );
    }
    else
    {
      tested = aix_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "bos.rte.control");
    }
    
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_E5423CAF8FB811E5918CBCAEC565249C.NASL
    descriptionreports : CVE-2015-5312 Another entity expansion issue (David Drysdale). CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey (David Drysdale). CVE-2015-7498 Avoid processing entities after encoding conversion failures (Daniel Veillard). CVE-2015-7499 (1) Add xmlHaltParser() to stop the parser (Daniel Veillard). CVE-2015-7499 (2) Detect incoherency on GROW (Daniel Veillard). CVE-2015-7500 Fix memory access error due to incorrect entities boundaries (Daniel Veillard). CVE-2015-7941 (1) Stop parsing on entities boundaries errors (Daniel Veillard). CVE-2015-7941 (2) Cleanup conditional section error handling (Daniel Veillard). CVE-2015-7942 Another variation of overflow in Conditional sections (Daniel Veillard). CVE-2015-7942 (2) Fix an error in previous Conditional section patch (Daniel Veillard). CVE-2015-8035 Fix XZ compression support loop (Daniel Veillard). CVE-2015-8242 Buffer overead with HTML parser in push mode (Hugh Davenport)
    last seen2020-06-01
    modified2020-06-02
    plugin id87000
    published2015-11-23
    reporterThis script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87000
    titleFreeBSD : libxml2 -- multiple vulnerabilities (e5423caf-8fb8-11e5-918c-bcaec565249c)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the FreeBSD VuXML database :
    #
    # Copyright 2003-2018 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #    copyright notice, this list of conditions and the following
    #    disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #    published online in any format, converted to PDF, PostScript,
    #    RTF and other formats) must reproduce the above copyright
    #    notice, this list of conditions and the following disclaimer
    #    in the documentation and/or other materials provided with the
    #    distribution.
    # 
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(87000);
      script_version("2.7");
      script_cvs_date("Date: 2018/11/23 12:49:57");
    
      script_cve_id("CVE-2015-5312", "CVE-2015-7497", "CVE-2015-7498", "CVE-2015-7499", "CVE-2015-7500", "CVE-2015-7941", "CVE-2015-7942", "CVE-2015-8035", "CVE-2015-8241", "CVE-2015-8242");
    
      script_name(english:"FreeBSD : libxml2 -- multiple vulnerabilities (e5423caf-8fb8-11e5-918c-bcaec565249c)");
      script_summary(english:"Checks for updated package in pkg_info output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote FreeBSD host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "reports :
    
    CVE-2015-5312 Another entity expansion issue (David Drysdale).
    
    CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey
    (David Drysdale).
    
    CVE-2015-7498 Avoid processing entities after encoding conversion
    failures (Daniel Veillard).
    
    CVE-2015-7499 (1) Add xmlHaltParser() to stop the parser (Daniel
    Veillard).
    
    CVE-2015-7499 (2) Detect incoherency on GROW (Daniel Veillard).
    
    CVE-2015-7500 Fix memory access error due to incorrect entities
    boundaries (Daniel Veillard).
    
    CVE-2015-7941 (1) Stop parsing on entities boundaries errors (Daniel
    Veillard).
    
    CVE-2015-7941 (2) Cleanup conditional section error handling (Daniel
    Veillard).
    
    CVE-2015-7942 Another variation of overflow in Conditional sections
    (Daniel Veillard).
    
    CVE-2015-7942 (2) Fix an error in previous Conditional section patch
    (Daniel Veillard).
    
    CVE-2015-8035 Fix XZ compression support loop (Daniel Veillard).
    
    CVE-2015-8242 Buffer overead with HTML parser in push mode (Hugh
    Davenport)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://xmlsoft.org/news.html"
      );
      # http://www.openwall.com/lists/oss-security/2015/11/18/23
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.openwall.com/lists/oss-security/2015/11/18/23"
      );
      # https://vuxml.freebsd.org/freebsd/e5423caf-8fb8-11e5-918c-bcaec565249c.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?bf2b1197"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:libxml2");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2015/11/20");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/11/20");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/11/23");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"FreeBSD Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("freebsd_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
    if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (pkg_test(save_report:TRUE, pkg:"libxml2<2.9.3")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyF5 Networks Local Security Checks
    NASL idF5_BIGIP_SOL61570943.NASL
    descriptionCVE-2015-5312 The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660. CVE-2015-7497 Heap-based buffer overflow in the xmlDictComputeFastQKey function in dict.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors. CVE-2015-7498 Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors related to extracting errors after an encoding conversion failure. CVE-2015-7499 Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors. CVE-2015-7500 The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via unspecified vectors related to incorrect entities boundaries and start tags. CVE-2015-7941 libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities. CVE-2015-7942 The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941. CVE-2015-8241 The xmlNextChar function in libxml2 2.9.2 does not properly check the state, which allows context-dependent attackers to cause a denial of service (heap-based buffer over-read and application crash) or obtain sensitive information via crafted XML data. CVE-2015-8242 The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (stack-based buffer over-read and application crash) or obtain sensitive information via crafted XML data. CVE-2015-8317 The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an (1) unterminated encoding value or (2) incomplete XML declaration in XML data, which triggers an out-of-bounds heap read.
    last seen2020-06-01
    modified2020-06-02
    plugin id88742
    published2016-02-16
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88742
    titleF5 Networks BIG-IP : Multiple libXML2 vulnerabilities (K61570943)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from F5 Networks BIG-IP Solution K61570943.
    #
    # The text description of this plugin is (C) F5 Networks.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(88742);
      script_version("2.9");
      script_cvs_date("Date: 2019/01/04 10:03:40");
    
      script_cve_id("CVE-2014-3660", "CVE-2015-5312", "CVE-2015-7497", "CVE-2015-7498", "CVE-2015-7499", "CVE-2015-7500", "CVE-2015-7941", "CVE-2015-7942", "CVE-2015-8241", "CVE-2015-8242", "CVE-2015-8317");
      script_bugtraq_id(70644);
    
      script_name(english:"F5 Networks BIG-IP : Multiple libXML2 vulnerabilities (K61570943)");
      script_summary(english:"Checks the BIG-IP version.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote device is missing a vendor-supplied security patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "CVE-2015-5312 The xmlStringLenDecodeEntities function in parser.c in
    libxml2 before 2.9.3 does not properly prevent entity expansion, which
    allows context-dependent attackers to cause a denial of service (CPU
    consumption) via crafted XML data, a different vulnerability than
    CVE-2014-3660.
    
    CVE-2015-7497 Heap-based buffer overflow in the xmlDictComputeFastQKey
    function in dict.c in libxml2 before 2.9.3 allows context-dependent
    attackers to cause a denial of service via unspecified vectors.
    
    CVE-2015-7498 Heap-based buffer overflow in the xmlParseXmlDecl
    function in parser.c in libxml2 before 2.9.3 allows context-dependent
    attackers to cause a denial of service via unspecified vectors related
    to extracting errors after an encoding conversion failure.
    
    CVE-2015-7499 Heap-based buffer overflow in the xmlGROW function in
    parser.c in libxml2 before 2.9.3 allows context-dependent attackers to
    obtain sensitive process memory information via unspecified vectors.
    
    CVE-2015-7500 The xmlParseMisc function in parser.c in libxml2 before
    2.9.3 allows context-dependent attackers to cause a denial of service
    (out-of-bounds heap read) via unspecified vectors related to incorrect
    entities boundaries and start tags.
    
    CVE-2015-7941 libxml2 2.9.2 does not properly stop parsing invalid
    input, which allows context-dependent attackers to cause a denial of
    service (out-of-bounds read and libxml2 crash) via crafted XML data to
    the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function
    in parser.c, as demonstrated by non-terminated entities.
    
    CVE-2015-7942 The xmlParseConditionalSections function in parser.c in
    libxml2 does not properly skip intermediary entities when it stops
    parsing invalid input, which allows context-dependent attackers to
    cause a denial of service (out-of-bounds read and crash) via crafted
    XML data, a different vulnerability than CVE-2015-7941.
    
    CVE-2015-8241 The xmlNextChar function in libxml2 2.9.2 does not
    properly check the state, which allows context-dependent attackers to
    cause a denial of service (heap-based buffer over-read and application
    crash) or obtain sensitive information via crafted XML data.
    
    CVE-2015-8242 The xmlSAX2TextNode function in SAX2.c in the push
    interface in the HTML parser in libxml2 before 2.9.3 allows
    context-dependent attackers to cause a denial of service (stack-based
    buffer over-read and application crash) or obtain sensitive
    information via crafted XML data.
    
    CVE-2015-8317 The xmlParseXMLDecl function in parser.c in libxml2
    before 2.9.3 allows context-dependent attackers to obtain sensitive
    information via an (1) unterminated encoding value or (2) incomplete
    XML declaration in XML data, which triggers an out-of-bounds heap
    read."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://support.f5.com/csp/article/K61570943"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade to one of the non-vulnerable versions listed in the F5
    Solution K61570943."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"potential_vulnerability", value:"true");
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_access_policy_manager");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_advanced_firewall_manager");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_application_acceleration_manager");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_application_security_manager");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_application_visibility_and_reporting");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_global_traffic_manager");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_link_controller");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_local_traffic_manager");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_policy_enforcement_manager");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_wan_optimization_manager");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_webaccelerator");
      script_set_attribute(attribute:"cpe", value:"cpe:/h:f5:big-ip");
      script_set_attribute(attribute:"cpe", value:"cpe:/h:f5:big-ip_protocol_security_manager");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2016/02/15");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/02/16");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"F5 Networks Local Security Checks");
    
      script_dependencies("f5_bigip_detect.nbin");
      script_require_keys("Host/local_checks_enabled", "Host/BIG-IP/hotfix", "Host/BIG-IP/modules", "Host/BIG-IP/version", "Settings/ParanoidReport");
    
      exit(0);
    }
    
    
    include("f5_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    version = get_kb_item("Host/BIG-IP/version");
    if ( ! version ) audit(AUDIT_OS_NOT, "F5 Networks BIG-IP");
    if ( isnull(get_kb_item("Host/BIG-IP/hotfix")) ) audit(AUDIT_KB_MISSING, "Host/BIG-IP/hotfix");
    if ( ! get_kb_item("Host/BIG-IP/modules") ) audit(AUDIT_KB_MISSING, "Host/BIG-IP/modules");
    
    sol = "K61570943";
    vmatrix = make_array();
    
    if (report_paranoia < 2) audit(AUDIT_PARANOID);
    
    # AFM
    vmatrix["AFM"] = make_array();
    vmatrix["AFM"]["affected"  ] = make_list("11.3.0-11.6.0");
    vmatrix["AFM"]["unaffected"] = make_list("12.0.0-12.1.0");
    
    # AM
    vmatrix["AM"] = make_array();
    vmatrix["AM"]["affected"  ] = make_list("11.4.0-11.6.0");
    vmatrix["AM"]["unaffected"] = make_list("12.0.0-12.1.0");
    
    # APM
    vmatrix["APM"] = make_array();
    vmatrix["APM"]["affected"  ] = make_list("11.0.0-11.6.0","10.1.0-10.2.4");
    vmatrix["APM"]["unaffected"] = make_list("12.0.0-12.1.0");
    
    # ASM
    vmatrix["ASM"] = make_array();
    vmatrix["ASM"]["affected"  ] = make_list("11.0.0-11.6.0","10.1.0-10.2.4");
    vmatrix["ASM"]["unaffected"] = make_list("12.0.0-12.1.0");
    
    # AVR
    vmatrix["AVR"] = make_array();
    vmatrix["AVR"]["affected"  ] = make_list("11.0.0-11.6.0");
    vmatrix["AVR"]["unaffected"] = make_list("12.0.0-12.1.0");
    
    # LC
    vmatrix["LC"] = make_array();
    vmatrix["LC"]["affected"  ] = make_list("11.0.0-11.6.0","10.1.0-10.2.4");
    vmatrix["LC"]["unaffected"] = make_list("12.0.0-12.1.0");
    
    # LTM
    vmatrix["LTM"] = make_array();
    vmatrix["LTM"]["affected"  ] = make_list("11.0.0-11.6.0","10.1.0-10.2.4");
    vmatrix["LTM"]["unaffected"] = make_list("12.0.0-12.1.0");
    
    # PEM
    vmatrix["PEM"] = make_array();
    vmatrix["PEM"]["affected"  ] = make_list("11.3.0-11.6.0");
    vmatrix["PEM"]["unaffected"] = make_list("12.0.0-12.1.0");
    
    
    if (bigip_is_affected(vmatrix:vmatrix, sol:sol))
    {
      if (report_verbosity > 0) security_hole(port:0, extra:bigip_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = bigip_get_tested_modules();
      audit_extra = "For BIG-IP module(s) " + tested + ",";
      if (tested) audit(AUDIT_INST_VER_NOT_VULN, audit_extra, version);
      else audit(AUDIT_HOST_NOT, "running any of the affected modules");
    }
    
  • NASL familyAmazon Linux Local Security Checks
    NASL idAL2_ALAS-2019-1220.NASL
    descriptionA denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information.(CVE-2015-8242) A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash.(CVE-2015-7500) A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information.(CVE-2015-8317) A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash.(CVE-2015-7497) A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash.(CVE-2015-7498) A denial of service flaw was found in the way the libxml2 library parsed certain XML files. An attacker could provide a specially crafted XML file that, when parsed by an application using libxml2, could cause that application to use an excessive amount of memory.(CVE-2015-1819) A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash.(CVE-2015-7941) A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information.(CVE-2015-7499) A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information.(CVE-2015-8241) A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU.(CVE-2015-5312) A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an application linked against libxml2, would cause the application to crash causing a denial of service.(CVE-2015-7942) It was discovered that libxml2 could access out-of-bounds memory when parsing unclosed HTML comments. A remote attacker could provide a specially crafted XML file that, when processed by an application linked against libxml2, could cause the application to disclose heap memory contents.(CVE-2015-8710)
    last seen2020-06-01
    modified2020-06-02
    plugin id125603
    published2019-05-31
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125603
    titleAmazon Linux 2 : libxml2 (ALAS-2019-1220)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Amazon Linux 2 Security Advisory ALAS-2019-1220.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(125603);
      script_version("1.3");
      script_cvs_date("Date: 2020/01/13");
    
      script_cve_id("CVE-2015-1819", "CVE-2015-5312", "CVE-2015-7497", "CVE-2015-7498", "CVE-2015-7499", "CVE-2015-7500", "CVE-2015-7941", "CVE-2015-7942", "CVE-2015-8241", "CVE-2015-8242", "CVE-2015-8317", "CVE-2015-8710");
      script_xref(name:"ALAS", value:"2019-1220");
    
      script_name(english:"Amazon Linux 2 : libxml2 (ALAS-2019-1220)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Amazon Linux 2 host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "A denial of service flaw was found in libxml2. A remote attacker could
    provide a specially crafted XML or HTML file that, when processed by
    an application using libxml2, would cause that application to leak
    potentially sensitive information.(CVE-2015-8242)
    
    A denial of service flaw was found in libxml2. A remote attacker could
    provide a specially crafted XML or HTML file that, when processed by
    an application using libxml2, would cause that application to
    crash.(CVE-2015-7500)
    
    A denial of service flaw was found in libxml2. A remote attacker could
    provide a specially crafted XML or HTML file that, when processed by
    an application using libxml2, would cause that application to leak
    potentially sensitive information.(CVE-2015-8317)
    
    A denial of service flaw was found in libxml2. A remote attacker could
    provide a specially crafted XML or HTML file that, when processed by
    an application using libxml2, would cause that application to
    crash.(CVE-2015-7497)
    
    A denial of service flaw was found in libxml2. A remote attacker could
    provide a specially crafted XML or HTML file that, when processed by
    an application using libxml2, would cause that application to
    crash.(CVE-2015-7498)
    
    A denial of service flaw was found in the way the libxml2 library
    parsed certain XML files. An attacker could provide a specially
    crafted XML file that, when parsed by an application using libxml2,
    could cause that application to use an excessive amount of
    memory.(CVE-2015-1819)
    
    A denial of service flaw was found in libxml2. A remote attacker could
    provide a specially crafted XML or HTML file that, when processed by
    an application using libxml2, would cause that application to
    crash.(CVE-2015-7941)
    
    A denial of service flaw was found in libxml2. A remote attacker could
    provide a specially crafted XML or HTML file that, when processed by
    an application using libxml2, would cause that application to leak
    potentially sensitive information.(CVE-2015-7499)
    
    A denial of service flaw was found in libxml2. A remote attacker could
    provide a specially crafted XML or HTML file that, when processed by
    an application using libxml2, would cause that application to leak
    potentially sensitive information.(CVE-2015-8241)
    
    A denial of service flaw was found in libxml2. A remote attacker could
    provide a specially crafted XML or HTML file that, when processed by
    an application using libxml2, would cause that application to use an
    excessive amount of CPU.(CVE-2015-5312)
    
    A heap-based buffer overflow flaw was found in the way libxml2 parsed
    certain crafted XML input. A remote attacker could provide a specially
    crafted XML file that, when opened in an application linked against
    libxml2, would cause the application to crash causing a denial of
    service.(CVE-2015-7942)
    
    It was discovered that libxml2 could access out-of-bounds memory when
    parsing unclosed HTML comments. A remote attacker could provide a
    specially crafted XML file that, when processed by an application
    linked against libxml2, could cause the application to disclose heap
    memory contents.(CVE-2015-8710)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://alas.aws.amazon.com/AL2/ALAS-2019-1220.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Run 'yum update libxml2' to update your system."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libxml2");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libxml2-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libxml2-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libxml2-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libxml2-static");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2015/08/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/05/30");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/05/31");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Amazon Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/AmazonLinux/release");
    if (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, "Amazon Linux");
    os_ver = pregmatch(pattern: "^AL(A|\d)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
    os_ver = os_ver[1];
    if (os_ver != "2")
    {
      if (os_ver == 'A') os_ver = 'AMI';
      audit(AUDIT_OS_NOT, "Amazon Linux 2", "Amazon Linux " + os_ver);
    }
    
    if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (rpm_check(release:"AL2", reference:"libxml2-2.9.1-6.amzn2.3.2")) flag++;
    if (rpm_check(release:"AL2", reference:"libxml2-debuginfo-2.9.1-6.amzn2.3.2")) flag++;
    if (rpm_check(release:"AL2", reference:"libxml2-devel-2.9.1-6.amzn2.3.2")) flag++;
    if (rpm_check(release:"AL2", reference:"libxml2-python-2.9.1-6.amzn2.3.2")) flag++;
    if (rpm_check(release:"AL2", reference:"libxml2-static-2.9.1-6.amzn2.3.2")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxml2 / libxml2-debuginfo / libxml2-devel / libxml2-python / etc");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-0030-1.NASL
    descriptionThis update fixes the following security issues : - CVE-2015-1819 Enforce the reader to run in constant memory [bnc#928193] - CVE-2015-7941 Fix out of bound read with crafted xml input by stopping parsing on entities boundaries errors [bnc#951734] - CVE-2015-7942 Fix another variation of overflow in Conditional sections [bnc#951735] - CVE-2015-8241 Avoid extra processing of MarkupDecl when EOF [bnc#956018] - CVE-2015-8242 Buffer overead with HTML parser in push mode [bnc#956021] - CVE-2015-8317 Return if the encoding declaration is broken or encoding conversion failed [bnc#956260] - CVE-2015-5312 Fix another entity expansion issue [bnc#957105] - CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey [bnc#957106] - CVE-2015-7498 Processes entities after encoding conversion failures [bnc#957107] - CVE-2015-7499 Add xmlHaltParser() to stop the parser / Detect incoherency on GROW [bnc#957109] - CVE-2015-7500 Fix memory access error due to incorrect entities boundaries [bnc#957110] Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id87862
    published2016-01-12
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87862
    titleSUSE SLED11 / SLES11 Security Update : libxml2 (SUSE-SU-2016:0030-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from SUSE update advisory SUSE-SU-2016:0030-1.
    # The text itself is copyright (C) SUSE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(87862);
      script_version("2.8");
      script_cvs_date("Date: 2019/09/11 11:22:13");
    
      script_cve_id("CVE-2015-1819", "CVE-2015-5312", "CVE-2015-7497", "CVE-2015-7498", "CVE-2015-7499", "CVE-2015-7500", "CVE-2015-7941", "CVE-2015-7942", "CVE-2015-8241", "CVE-2015-8242", "CVE-2015-8317");
      script_bugtraq_id(75570);
    
      script_name(english:"SUSE SLED11 / SLES11 Security Update : libxml2 (SUSE-SU-2016:0030-1)");
      script_summary(english:"Checks rpm output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SUSE host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update fixes the following security issues :
    
      - CVE-2015-1819 Enforce the reader to run in constant
        memory [bnc#928193]
    
      - CVE-2015-7941 Fix out of bound read with crafted xml
        input by stopping parsing on entities boundaries errors
        [bnc#951734]
    
      - CVE-2015-7942 Fix another variation of overflow in
        Conditional sections [bnc#951735]
    
      - CVE-2015-8241 Avoid extra processing of MarkupDecl when
        EOF [bnc#956018]
    
      - CVE-2015-8242 Buffer overead with HTML parser in push
        mode [bnc#956021]
    
      - CVE-2015-8317 Return if the encoding declaration is
        broken or encoding conversion failed [bnc#956260]
    
      - CVE-2015-5312 Fix another entity expansion issue
        [bnc#957105]
    
      - CVE-2015-7497 Avoid an heap buffer overflow in
        xmlDictComputeFastQKey [bnc#957106]
    
      - CVE-2015-7498 Processes entities after encoding
        conversion failures [bnc#957107]
    
      - CVE-2015-7499 Add xmlHaltParser() to stop the parser /
        Detect incoherency on GROW [bnc#957109]
    
      - CVE-2015-7500 Fix memory access error due to incorrect
        entities boundaries [bnc#957110]
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the SUSE security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=928193"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=951734"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=951735"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=956018"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=956021"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=956260"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=957105"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=957106"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=957107"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=957109"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=957110"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-1819/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-5312/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-7497/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-7498/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-7499/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-7500/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-7941/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-7942/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-8241/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-8242/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-8317/"
      );
      # https://www.suse.com/support/update/announcement/2016/suse-su-20160030-1/
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?2e3022a8"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "To install this SUSE Security Update use YaST online_update.
    Alternatively you can run the command listed for your product :
    
    SUSE Linux Enterprise Software Development Kit 11-SP4 :
    
    zypper in -t patch sdksp4-libxml2-20151221-12298=1
    
    SUSE Linux Enterprise Software Development Kit 11-SP3 :
    
    zypper in -t patch sdksp3-libxml2-20151221-12298=1
    
    SUSE Linux Enterprise Server for VMWare 11-SP3 :
    
    zypper in -t patch slessp3-libxml2-20151221-12298=1
    
    SUSE Linux Enterprise Server 11-SP4 :
    
    zypper in -t patch slessp4-libxml2-20151221-12298=1
    
    SUSE Linux Enterprise Server 11-SP3 :
    
    zypper in -t patch slessp3-libxml2-20151221-12298=1
    
    SUSE Linux Enterprise Desktop 11-SP4 :
    
    zypper in -t patch sledsp4-libxml2-20151221-12298=1
    
    SUSE Linux Enterprise Desktop 11-SP3 :
    
    zypper in -t patch sledsp3-libxml2-20151221-12298=1
    
    SUSE Linux Enterprise Debuginfo 11-SP4 :
    
    zypper in -t patch dbgsp4-libxml2-20151221-12298=1
    
    SUSE Linux Enterprise Debuginfo 11-SP3 :
    
    zypper in -t patch dbgsp3-libxml2-20151221-12298=1
    
    To bring your system up-to-date, use 'zypper patch'."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libxml2");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libxml2-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libxml2-python");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2015/08/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/01/05");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/01/12");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
    os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(SLED11|SLES11)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED11 / SLES11", "SUSE " + os_ver);
    
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
    
    sp = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(sp)) sp = "0";
    if (os_ver == "SLES11" && (! preg(pattern:"^(3|4)$", string:sp))) audit(AUDIT_OS_NOT, "SLES11 SP3/4", os_ver + " SP" + sp);
    if (os_ver == "SLED11" && (! preg(pattern:"^(3|4)$", string:sp))) audit(AUDIT_OS_NOT, "SLED11 SP3/4", os_ver + " SP" + sp);
    
    
    flag = 0;
    if (rpm_check(release:"SLES11", sp:"4", cpu:"x86_64", reference:"libxml2-32bit-2.7.6-0.34.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"4", cpu:"s390x", reference:"libxml2-32bit-2.7.6-0.34.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"4", reference:"libxml2-2.7.6-0.34.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"4", reference:"libxml2-doc-2.7.6-0.34.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"4", reference:"libxml2-python-2.7.6-0.34.4")) flag++;
    if (rpm_check(release:"SLES11", sp:"3", cpu:"x86_64", reference:"libxml2-32bit-2.7.6-0.34.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"3", cpu:"s390x", reference:"libxml2-32bit-2.7.6-0.34.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"3", reference:"libxml2-2.7.6-0.34.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"3", reference:"libxml2-doc-2.7.6-0.34.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"3", reference:"libxml2-python-2.7.6-0.34.4")) flag++;
    if (rpm_check(release:"SLED11", sp:"4", cpu:"x86_64", reference:"libxml2-2.7.6-0.34.1")) flag++;
    if (rpm_check(release:"SLED11", sp:"4", cpu:"x86_64", reference:"libxml2-python-2.7.6-0.34.4")) flag++;
    if (rpm_check(release:"SLED11", sp:"4", cpu:"x86_64", reference:"libxml2-32bit-2.7.6-0.34.1")) flag++;
    if (rpm_check(release:"SLED11", sp:"4", cpu:"i586", reference:"libxml2-2.7.6-0.34.1")) flag++;
    if (rpm_check(release:"SLED11", sp:"4", cpu:"i586", reference:"libxml2-python-2.7.6-0.34.4")) flag++;
    if (rpm_check(release:"SLED11", sp:"3", cpu:"x86_64", reference:"libxml2-2.7.6-0.34.1")) flag++;
    if (rpm_check(release:"SLED11", sp:"3", cpu:"x86_64", reference:"libxml2-python-2.7.6-0.34.4")) flag++;
    if (rpm_check(release:"SLED11", sp:"3", cpu:"x86_64", reference:"libxml2-32bit-2.7.6-0.34.1")) flag++;
    if (rpm_check(release:"SLED11", sp:"3", cpu:"i586", reference:"libxml2-2.7.6-0.34.1")) flag++;
    if (rpm_check(release:"SLED11", sp:"3", cpu:"i586", reference:"libxml2-python-2.7.6-0.34.4")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxml2");
    }
    
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2015-2550.NASL
    descriptionUpdated libxml2 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The libxml2 library is a development toolbox providing the implementation of various XML standards. Several denial of service flaws were found in libxml2, a library providing support for reading, modifying, and writing XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially sensitive information, or in certain cases crash the application. (CVE-2015-1819, CVE-2015-5312, CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500 CVE-2015-7941, CVE-2015-7942, CVE-2015-8241, CVE-2015-8242, CVE-2015-8317, BZ#1213957, BZ#1281955) Red Hat would like to thank the GNOME project for reporting CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500, CVE-2015-8241, CVE-2015-8242, and CVE-2015-8317. Upstream acknowledges Kostya Serebryany of Google as the original reporter of CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, and CVE-2015-7500; Hugh Davenport as the original reporter of CVE-2015-8241 and CVE-2015-8242; and Hanno Boeck as the original reporter of CVE-2015-8317. The CVE-2015-1819 issue was discovered by Florian Weimer of Red Hat Product Security. All libxml2 users are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. The desktop must be restarted (log out, then log back in) for this update to take effect.
    last seen2020-04-16
    modified2015-12-08
    plugin id87224
    published2015-12-08
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87224
    titleCentOS 7 : libxml2 (CESA-2015:2550)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2015:2550 and 
    # CentOS Errata and Security Advisory 2015:2550 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(87224);
      script_version("2.15");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/15");
    
      script_cve_id("CVE-2015-1819", "CVE-2015-5312", "CVE-2015-7497", "CVE-2015-7498", "CVE-2015-7499", "CVE-2015-7500", "CVE-2015-7941", "CVE-2015-7942", "CVE-2015-8241", "CVE-2015-8242", "CVE-2015-8317", "CVE-2015-8710");
      script_xref(name:"RHSA", value:"2015:2550");
    
      script_name(english:"CentOS 7 : libxml2 (CESA-2015:2550)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote CentOS host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated libxml2 packages that fix multiple security issues are now
    available for Red Hat Enterprise Linux 7.
    
    Red Hat Product Security has rated this update as having Moderate
    security impact. Common Vulnerability Scoring System (CVSS) base
    scores, which give detailed severity ratings, are available for each
    vulnerability from the CVE links in the References section.
    
    The libxml2 library is a development toolbox providing the
    implementation of various XML standards.
    
    Several denial of service flaws were found in libxml2, a library
    providing support for reading, modifying, and writing XML and HTML
    files. A remote attacker could provide a specially crafted XML or HTML
    file that, when processed by an application using libxml2, would cause
    that application to use an excessive amount of CPU, leak potentially
    sensitive information, or in certain cases crash the application.
    (CVE-2015-1819, CVE-2015-5312, CVE-2015-7497, CVE-2015-7498,
    CVE-2015-7499, CVE-2015-7500 CVE-2015-7941, CVE-2015-7942,
    CVE-2015-8241, CVE-2015-8242, CVE-2015-8317, BZ#1213957, BZ#1281955)
    
    Red Hat would like to thank the GNOME project for reporting
    CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500,
    CVE-2015-8241, CVE-2015-8242, and CVE-2015-8317. Upstream acknowledges
    Kostya Serebryany of Google as the original reporter of CVE-2015-7497,
    CVE-2015-7498, CVE-2015-7499, and CVE-2015-7500; Hugh Davenport as the
    original reporter of CVE-2015-8241 and CVE-2015-8242; and Hanno Boeck
    as the original reporter of CVE-2015-8317. The CVE-2015-1819 issue was
    discovered by Florian Weimer of Red Hat Product Security.
    
    All libxml2 users are advised to upgrade to these updated packages,
    which contain a backported patch to correct these issues. The desktop
    must be restarted (log out, then log back in) for this update to take
    effect."
      );
      # https://lists.centos.org/pipermail/centos-cr-announce/2015-December/002730.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?29b52cd4"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected libxml2 packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2015-8710");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libxml2");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libxml2-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libxml2-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libxml2-static");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:7");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2015/08/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/12/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/12/08");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"CentOS Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/CentOS/release");
    if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
    os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 7.x", "CentOS " + os_ver);
    
    if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libxml2-2.9.1-6.el7_2.2", el_string:"el7_2")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libxml2-devel-2.9.1-6.el7_2.2", el_string:"el7_2")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libxml2-python-2.9.1-6.el7_2.2", el_string:"el7_2")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libxml2-static-2.9.1-6.el7_2.2", el_string:"el7_2")) flag++;
    
    
    if (flag)
    {
      cr_plugin_caveat = '\n' +
        'NOTE: The security advisory associated with this vulnerability has a\n' +
        'fixed package version that may only be available in the continuous\n' +
        'release (CR) repository for CentOS, until it is present in the next\n' +
        'point release of CentOS.\n\n' +
    
        'If an equal or higher package level does not exist in the baseline\n' +
        'repository for your major version of CentOS, then updates from the CR\n' +
        'repository will need to be applied in order to address the\n' +
        'vulnerability.\n';
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get() + cr_plugin_caveat
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxml2 / libxml2-devel / libxml2-python / libxml2-static");
    }
    
  • NASL familyMisc.
    NASL idAPPLETV_9_2.NASL
    descriptionAccording to its banner, the remote Apple TV device is a version prior to 9.2. It is, therefore, affected by the following vulnerabilities : - An XML external entity (XXE) expansion flaw exists in libxml2 due to the XML parser accepting entities from untrusted sources. An unauthenticated, remote attacker can exploit this, via crafted XML data, to cause a denial of service through resource exhaustion. (CVE-2015-1819) - An XML external entity (XXE) injection flaw exists in libxml2 in file parser.c due to the XML parser accepting entities from untrusted sources. An unauthenticated, remote attacker can exploit this, via crafted XML data, to cause a denial of service or to disclose sensitive information. (CVE-2015-5312) - A heap buffer overflow condition exists in libxml2 in the xmlGROW() function within file parser.c while handling XML data. An unauthenticated, remote attacker can exploit this to disclose sensitive information. (CVE-2015-7499) - An out-of-bounds heap read error exists in libxml2 in the xmlParseMisc() function within file parser.c while handling entity boundaries. An unauthenticated, remote attacker can exploit this to cause a denial of service. (CVE-2015-7500) - An out-of-bounds read error exists in libxml2 in the xmlParseConditionalSections() function within file parser.c due to a failure to properly skip intermediary entities when it stops parsing invalid input. An unauthenticated, remote attacker can exploit this, via crafted XML data, to cause a denial of service. (CVE-2015-7942) - A flaw exists in libxml2 in the xz_decomp() function within file xzlib.c due to a failure to properly detect compression errors when handling compressed XML content. An unauthenticated, remote attacker can exploit this, via crafted XML data, to cause an infinite loop, resulting in a denial of service. (CVE-2015-8035) - A out-of-bounds read error exists in libxml2 in the xmlSAX2TextNode() function within file SAX2.c due to improper sanitization of input data. An unauthenticated, remote attacker can exploit this, via crafted XML data, to cause a denial of service or to disclose sensitive information. (CVE-2015-8242) - A use-after-free error exists in Nghttp2 within file lib/nghttp2_session.c when handling idle streams. An unauthenticated, remote attacker can exploit this to deference already freed memory, allowing the execution of arbitrary code. (CVE-2015-8659) - An overflow condition exists in the Broadcom Wi-Fi driver due to improper validation of data while handling SSID or WPS_ID_DEVICE_NAME values. An unauthenticated, adjacent attacker can exploit this, via a crafted wireless control message packet, to cause a denial of service or to execute arbitrary code. (CVE-2016-0801) - An overflow condition exists in the Broadcom Wi-Fi driver due to improper validation of user-supplied input when handling the packet length of event messages. An unauthenticated, adjacent attacker can exploit this, via a crafted wireless control message packet, to cause a denial of service or to execute arbitrary code. (CVE-2016-0802) - A flaw exists in FontParser due to improper validation of user-supplied input when handling encoded fonts that contain invalid characters. An unauthenticated, remote attacker can exploit this, via a crafted PDF document, to corrupt memory, resulting in a denial of service or the execution arbitrary code. (CVE-2016-1740) - A flaw exists in IOHIDFamily due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a crafted application, to gain access to kernel memory layout information. (CVE-2016-1748) - A use-after-free error exists in the kernel that allows an unauthenticated, remote attacker to execute arbitrary code via a crafted application. (CVE-2016-1750) - A flaw exists in the kernel due to a failure to properly restrict execution permissions. An unauthenticated, remote attacker can exploit this, via a crafted application, to bypass code-signing protection mechanisms. (CVE-2016-1751) - An unspecified flaw exists in the kernel that allows a local attacker to cause a denial of service via a crafted application. (CVE-2016-1752) - An integer overflow condition exists in the kernel due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a crafted application, to gain elevated privileges. (CVE-2016-1753) - A memory corruption issue exists in the kernel due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, by convincing a user to install a malicious application, to cause a denial of service or execute arbitrary code. CVE-2016-1754) - A use-after-free error exists in the AppleKeyStore user client when handling multiple threads, which is triggered when one thread closes the user client while another attempts to call an external method. An unauthenticated, remote attacker can exploit this, by convincing a user to install a malicious application, to execute arbitrary code with elevated privileges. (CVE-2016-1755) - A flaw exists in libxml2 due to improper validation of user-supplied input while handling XML content. An unauthenticated, remote attacker can exploit this, via a crafted XML document, to cause a denial of service or to execute arbitrary code. (CVE-2016-1762) - An out-of-bounds write error exists in TrueTypeScaler due to improper validation of user-supplied input while handling bdat tables in TTF fonts. An unauthenticated, remote attacker can exploit this, via a crafted TTF font, to cause a denial or service or to execute arbitrary code. (CVE-2016-1775) - A flaw exists in WebKit due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a crafted website, to cause a denial of service or execute arbitrary code. (CVE-2016-1783) - An unspecified flaw exists in the History implementation of WebKit that allows an unauthenticated, remote attacker to cause a denial of service via a crafted website. (CVE-2016-1784) - A heap buffer overflow condition exists in Mozilla Network Security Services due to improper validation of user-supplied input while parsing ASN.1 structures. An unauthenticated, remote attacker can exploit this, via crafted ASN.1 data in an X.509 certificate, to cause a denial of service or execute arbitrary code. (CVE-2016-1950) Note that only 4th generation models are affected by these vulnerabilities, and this plugin only checks these models.
    last seen2020-06-01
    modified2020-06-02
    plugin id90309
    published2016-04-01
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90309
    titleApple TV < 9.2 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(90309);
      script_version("1.15");
      script_cvs_date("Date: 2019/11/19");
    
      script_cve_id(
        "CVE-2015-1819",
        "CVE-2015-5312",
        "CVE-2015-7499",
        "CVE-2015-7500",
        "CVE-2015-7942",
        "CVE-2015-8035",
        "CVE-2015-8242",
        "CVE-2015-8659",
        "CVE-2016-0801",
        "CVE-2016-0802",
        "CVE-2016-1740",
        "CVE-2016-1748",
        "CVE-2016-1750",
        "CVE-2016-1751",
        "CVE-2016-1752",
        "CVE-2016-1753",
        "CVE-2016-1754",
        "CVE-2016-1755",
        "CVE-2016-1762",
        "CVE-2016-1775",
        "CVE-2016-1783",
        "CVE-2016-1784",
        "CVE-2016-1950"
      );
      script_bugtraq_id(
        75570,
        77390,
        77681,
        79507,
        79509,
        79536,
        79562,
        80438
      );
      script_xref(name:"APPLE-SA", value:"APPLE-SA-2016-03-21-3");
    
      script_name(english:"Apple TV < 9.2 Multiple Vulnerabilities");
      script_summary(english:"Checks the build number.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote device is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "According to its banner, the remote Apple TV device is a version prior
    to 9.2. It is, therefore, affected by the following vulnerabilities :
    
      - An XML external entity (XXE) expansion flaw exists in
        libxml2 due to the XML parser accepting entities from
        untrusted sources. An unauthenticated, remote attacker
        can exploit this, via crafted XML data, to cause a
        denial of service through resource exhaustion.
        (CVE-2015-1819)
    
      - An XML external entity (XXE) injection flaw exists in
        libxml2 in file parser.c due to the XML parser accepting
        entities from untrusted sources. An unauthenticated,
        remote attacker can exploit this, via crafted XML data,
        to cause a denial of service or to disclose sensitive
        information. (CVE-2015-5312)
    
      - A heap buffer overflow condition exists in libxml2 in
        the xmlGROW() function within file parser.c while
        handling XML data. An unauthenticated, remote attacker
        can exploit this to disclose sensitive information.
        (CVE-2015-7499)
    
      - An out-of-bounds heap read error exists in libxml2 in
        the xmlParseMisc() function within file parser.c while
        handling entity boundaries. An unauthenticated, remote
        attacker can exploit this to cause a denial of service.
        (CVE-2015-7500)
    
      - An out-of-bounds read error exists in libxml2 in the
        xmlParseConditionalSections() function within file
        parser.c due to a failure to properly skip intermediary
        entities when it stops parsing invalid input. An
        unauthenticated, remote attacker can exploit this, via
        crafted XML data, to cause a denial of service.
        (CVE-2015-7942)
    
      - A flaw exists in libxml2 in the xz_decomp() function
        within file xzlib.c due to a failure to properly detect
        compression errors when handling compressed XML content.
        An unauthenticated, remote attacker can exploit this,
        via crafted XML data, to cause an infinite loop,
        resulting in a denial of service.
        (CVE-2015-8035)
    
      - A out-of-bounds read error exists in libxml2 in the
        xmlSAX2TextNode() function within file SAX2.c due to
        improper sanitization of input data. An unauthenticated,
        remote attacker can exploit this, via crafted XML data,
        to cause a denial of service or to disclose sensitive
        information. (CVE-2015-8242)
    
      - A use-after-free error exists in Nghttp2 within file
        lib/nghttp2_session.c when handling idle streams. An
        unauthenticated, remote attacker can exploit this to
        deference already freed memory, allowing the execution
        of arbitrary code. (CVE-2015-8659)
    
      - An overflow condition exists in the Broadcom Wi-Fi
        driver due to improper validation of data while handling
        SSID or WPS_ID_DEVICE_NAME values. An unauthenticated,
        adjacent attacker can exploit this, via a crafted
        wireless control message packet, to cause a denial of
        service or to execute arbitrary code. (CVE-2016-0801)
    
      - An overflow condition exists in the Broadcom Wi-Fi
        driver due to improper validation of user-supplied
        input when handling the packet length of event messages.
        An unauthenticated, adjacent attacker can exploit this,
        via a crafted wireless control message packet, to cause
        a denial of service or to execute arbitrary code.
        (CVE-2016-0802)
    
      - A flaw exists in FontParser due to improper validation
        of user-supplied input when handling encoded fonts that
        contain invalid characters. An unauthenticated, remote
        attacker can exploit this, via a crafted PDF document,
        to corrupt memory, resulting in a denial of service or
        the execution arbitrary code. (CVE-2016-1740)
    
      - A flaw exists in IOHIDFamily due to improper validation
        of user-supplied input. An unauthenticated, remote
        attacker can exploit this, via a crafted application,
        to gain access to kernel memory layout information.
        (CVE-2016-1748)
    
      - A use-after-free error exists in the kernel that allows
        an unauthenticated, remote attacker to execute arbitrary
        code via a crafted application. (CVE-2016-1750)
    
      - A flaw exists in the kernel due to a failure to properly
        restrict execution permissions. An unauthenticated,
        remote attacker can exploit this, via a crafted
        application, to bypass code-signing protection
        mechanisms. (CVE-2016-1751)
    
      - An unspecified flaw exists in the kernel that allows a
        local attacker to cause a denial of service via a
        crafted application. (CVE-2016-1752)
    
      - An integer overflow condition exists in the kernel due
        to improper validation of user-supplied input. An
        unauthenticated, remote attacker can exploit this, via
        a crafted application, to gain elevated privileges.
        (CVE-2016-1753)
    
      - A memory corruption issue exists in the kernel due to
        improper validation of user-supplied input. An
        unauthenticated, remote attacker can exploit this, by
        convincing a user to install a malicious application,
        to cause a denial of service or execute arbitrary code.
        CVE-2016-1754)
    
      - A use-after-free error exists in the AppleKeyStore user
        client when handling multiple threads, which is
        triggered when one thread closes the user client while
        another attempts to call an external method. An
        unauthenticated, remote attacker can exploit this, by
        convincing a user to install a malicious application, to
        execute arbitrary code with elevated privileges.
        (CVE-2016-1755)
    
      - A flaw exists in libxml2 due to improper validation of
        user-supplied input while handling XML content. An
        unauthenticated, remote attacker can exploit this, via a
        crafted XML document, to cause a denial of service or to
        execute arbitrary code. (CVE-2016-1762)
    
      - An out-of-bounds write error exists in TrueTypeScaler
        due to improper validation of user-supplied input while
        handling bdat tables in TTF fonts. An unauthenticated,
        remote attacker can exploit this, via a crafted TTF
        font, to cause a denial or service or to execute
        arbitrary code. (CVE-2016-1775)
    
      - A flaw exists in WebKit due to improper validation of
        user-supplied input. An unauthenticated, remote attacker
        can exploit this, via a crafted website, to cause a
        denial of service or execute arbitrary code.
        (CVE-2016-1783)
    
      - An unspecified flaw exists in the History implementation
        of WebKit that allows an unauthenticated, remote
        attacker to cause a denial of service via a crafted
        website. (CVE-2016-1784)
    
      - A heap buffer overflow condition exists in Mozilla
        Network Security Services due to improper validation of
        user-supplied input while parsing ASN.1 structures. An
        unauthenticated, remote attacker can exploit this, via
        crafted ASN.1 data in an X.509 certificate, to cause a
        denial of service or execute arbitrary code.
        (CVE-2016-1950)
    
    Note that only 4th generation models are affected by these
    vulnerabilities, and this plugin only checks these models.");
      script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT206169");
      # http://prod.lists.apple.com/archives/security-announce/2016/Mar/msg00002.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5c691f32");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Apple TV version 9.2 or later. Note that this update is
    available only for 4th generation models.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2015-8659");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2015/02/22");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/03/21");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/04/01");
    
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:apple:apple_tv");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Misc.");
    
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("appletv_version.nasl");
      script_require_keys("AppleTV/Version", "AppleTV/URL", "AppleTV/Port");
      script_require_ports("Services/www", 7000);
    
      exit(0);
    }
    
    include("appletv_func.inc");
    include("audit.inc");
    
    url = get_kb_item('AppleTV/URL');
    if (empty_or_null(url)) exit(0, 'Cannot determine Apple TV URL.');
    port = get_kb_item('AppleTV/Port');
    if (empty_or_null(port)) exit(0, 'Cannot determine Apple TV port.');
    
    build = get_kb_item('AppleTV/Version');
    if (empty_or_null(build)) audit(AUDIT_UNKNOWN_DEVICE_VER, 'Apple TV');
    
    model = get_kb_item('AppleTV/Model');
    if (empty_or_null(model)) exit(0, 'Cannot determine Apple TV model.');
    
    # fix
    fixed_build = "13Y234";
    tvos_ver = "9.2"; # for reporting purposes only
    
    # determine gen from the model
    gen = APPLETV_MODEL_GEN[model];
    
    appletv_check_version(
      build        : build,
      fix          : fixed_build,
      affected_gen : 4,
      fix_tvos_ver : tvos_ver,
      model        : model,
      gen          : gen,
      severity     : SECURITY_HOLE,
      port         : port,
      url          : url
    );
    
  • NASL familyAIX Local Security Checks
    NASL idAIX_U868931.NASL
    descriptionThe remote host is missing AIX PTF U868931, which is related to the security of the package bos.rte.control. Libxml2 is vulnerable to a denial of service, caused by a heap-based buffer overflow in the xmlParseEntityDecl or xmlParseConditionalSections function. By using a specially crafted XML data, a remote attacker could exploit this vulnerability to trigger an out-of-bounds read and cause the system to crash. Libxml2 is vulnerable to a denial of service, caused by a heap-based buffer overflow in the xmlParseConditionalSections function. By using a specially crafted XML data, a remote attacker could exploit this vulnerability to trigger an out-of-bounds read and cause the system to crash. libxml2 is vulnerable to a buffer overflow, caused by improper bounds checking by the XML parser in xmlNextChar. By using a malformed XML file, a local attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
    last seen2020-06-01
    modified2020-06-02
    plugin id91234
    published2016-05-19
    reporterThis script is Copyright (C) 2016 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/91234
    titleAIX 7.1 TL 4 : bos.rte.control (U868931)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were extracted
    # from AIX Security PTF U868931. The text itself is copyright (C)
    # International Business Machines Corp.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(91234);
      script_version("$Revision: 2.1 $");
      script_cvs_date("$Date: 2016/05/19 18:10:51 $");
    
      script_cve_id("CVE-2015-7941", "CVE-2015-7942", "CVE-2015-8241");
    
      script_name(english:"AIX 7.1 TL 4 : bos.rte.control (U868931)");
      script_summary(english:"Check for PTF U868931");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote AIX host is missing a vendor-supplied security patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is missing AIX PTF U868931, which is related to the
    security of the package bos.rte.control.
    
    Libxml2 is vulnerable to a denial of service, caused by a heap-based
    buffer overflow in the xmlParseEntityDecl or
    xmlParseConditionalSections function. By using a specially crafted XML
    data, a remote attacker could exploit this vulnerability to trigger an
    out-of-bounds read and cause the system to crash. Libxml2 is
    vulnerable to a denial of service, caused by a heap-based buffer
    overflow in the xmlParseConditionalSections function. By using a
    specially crafted XML data, a remote attacker could exploit this
    vulnerability to trigger an out-of-bounds read and cause the system to
    crash. libxml2 is vulnerable to a buffer overflow, caused by improper
    bounds checking by the XML parser in xmlNextChar. By using a malformed
    XML file, a local attacker could overflow a buffer and execute
    arbitrary code on the system or cause the application to crash."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www-01.ibm.com/support/docview.wss?uid=isg1IV80586"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Install the appropriate missing security-related fix."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:ibm:aix:7.1");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/01/20");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/01/20");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/05/19");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016 Tenable Network Security, Inc.");
      script_family(english:"AIX Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/AIX/oslevel", "Host/AIX/version", "Host/AIX/lslpp");
    
      exit(0);
    }
    
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("aix.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if ( ! get_kb_item("Host/AIX/version") ) audit(AUDIT_OS_NOT, "AIX");
    if ( ! get_kb_item("Host/AIX/lslpp") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    flag = 0;
    
    if ( aix_check_patch(ml:"710004", patch:"U868931", package:"bos.rte.control.7.1.4.1") < 0 ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:aix_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyAIX Local Security Checks
    NASL idAIX_U866671.NASL
    descriptionThe remote host is missing AIX PTF U866671, which is related to the security of the package bos.rte.control. Libxml2 is vulnerable to a denial of service, caused by a heap-based buffer overflow in the xmlParseEntityDecl or xmlParseConditionalSections function. By using a specially crafted XML data, a remote attacker could exploit this vulnerability to trigger an out-of-bounds read and cause the system to crash. Libxml2 is vulnerable to a denial of service, caused by a heap-based buffer overflow in the xmlParseConditionalSections function. By using a specially crafted XML data, a remote attacker could exploit this vulnerability to trigger an out-of-bounds read and cause the system to crash. libxml2 is vulnerable to a buffer overflow, caused by improper bounds checking by the XML parser in xmlNextChar. By using a malformed XML file, a local attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
    last seen2020-06-01
    modified2020-06-02
    plugin id91233
    published2016-05-19
    reporterThis script is Copyright (C) 2016 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/91233
    titleAIX 6.1 TL 9 : bos.rte.control (U866671)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were extracted
    # from AIX Security PTF U866671. The text itself is copyright (C)
    # International Business Machines Corp.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(91233);
      script_version("$Revision: 2.1 $");
      script_cvs_date("$Date: 2016/05/19 18:10:51 $");
    
      script_cve_id("CVE-2015-7941", "CVE-2015-7942", "CVE-2015-8241");
    
      script_name(english:"AIX 6.1 TL 9 : bos.rte.control (U866671)");
      script_summary(english:"Check for PTF U866671");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote AIX host is missing a vendor-supplied security patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is missing AIX PTF U866671, which is related to the
    security of the package bos.rte.control.
    
    Libxml2 is vulnerable to a denial of service, caused by a heap-based
    buffer overflow in the xmlParseEntityDecl or
    xmlParseConditionalSections function. By using a specially crafted XML
    data, a remote attacker could exploit this vulnerability to trigger an
    out-of-bounds read and cause the system to crash. Libxml2 is
    vulnerable to a denial of service, caused by a heap-based buffer
    overflow in the xmlParseConditionalSections function. By using a
    specially crafted XML data, a remote attacker could exploit this
    vulnerability to trigger an out-of-bounds read and cause the system to
    crash. libxml2 is vulnerable to a buffer overflow, caused by improper
    bounds checking by the XML parser in xmlNextChar. By using a malformed
    XML file, a local attacker could overflow a buffer and execute
    arbitrary code on the system or cause the application to crash."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www-01.ibm.com/support/docview.wss?uid=isg1IV80588"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Install the appropriate missing security-related fix."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:ibm:aix:6.1");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/01/20");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/01/20");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/05/19");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016 Tenable Network Security, Inc.");
      script_family(english:"AIX Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/AIX/oslevel", "Host/AIX/version", "Host/AIX/lslpp");
    
      exit(0);
    }
    
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("aix.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if ( ! get_kb_item("Host/AIX/version") ) audit(AUDIT_OS_NOT, "AIX");
    if ( ! get_kb_item("Host/AIX/lslpp") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    flag = 0;
    
    if ( aix_check_patch(ml:"610009", patch:"U866671", package:"bos.rte.control.6.1.9.101") < 0 ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:aix_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_10_11_4.NASL
    descriptionThe remote host is running a version of Mac OS X that is 10.11.x prior to 10.11.4. It is, therefore, affected by multiple vulnerabilities in the following components : - apache_mod_php - AppleRAID - AppleUSBNetworking - Bluetooth - Carbon - dyld - FontParser - HTTPProtocol - Intel Graphics Driver - IOFireWireFamily - IOGraphics - IOHIDFamily - IOUSBFamily - Kernel - libxml2 - Messages - NVIDIA Graphics Drivers - OpenSSH - OpenSSL - Python - QuickTime - Reminders - Ruby - Security - Tcl - TrueTypeScaler - Wi-Fi Note that successful exploitation of the most serious issues can result in arbitrary code execution.
    last seen2020-06-01
    modified2020-06-02
    plugin id90096
    published2016-03-22
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90096
    titleMac OS X 10.11.x < 10.11.4 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(90096);
      script_version("1.17");
      script_cvs_date("Date: 2019/11/20");
    
      script_cve_id(
        "CVE-2014-9495",
        "CVE-2015-0973",
        "CVE-2015-1819",
        "CVE-2015-3195",
        "CVE-2015-5312",
        "CVE-2015-7499",
        "CVE-2015-7500",
        "CVE-2015-7551",
        "CVE-2015-7942",
        "CVE-2015-8035",
        "CVE-2015-8126",
        "CVE-2015-8242",
        "CVE-2015-8472",
        "CVE-2015-8659",
        "CVE-2016-0777",
        "CVE-2016-0778",
        "CVE-2016-0801",
        "CVE-2016-0802",
        "CVE-2016-1732",
        "CVE-2016-1733",
        "CVE-2016-1734",
        "CVE-2016-1735",
        "CVE-2016-1736",
        "CVE-2016-1737",
        "CVE-2016-1738",
        "CVE-2016-1740",
        "CVE-2016-1741",
        "CVE-2016-1743",
        "CVE-2016-1744",
        "CVE-2016-1745",
        "CVE-2016-1746",
        "CVE-2016-1747",
        "CVE-2016-1748",
        "CVE-2016-1749",
        "CVE-2016-1750",
        "CVE-2016-1752",
        "CVE-2016-1753",
        "CVE-2016-1754",
        "CVE-2016-1755",
        "CVE-2016-1756",
        "CVE-2016-1757",
        "CVE-2016-1758",
        "CVE-2016-1759",
        "CVE-2016-1761",
        "CVE-2016-1762",
        "CVE-2016-1764",
        "CVE-2016-1767",
        "CVE-2016-1768",
        "CVE-2016-1769",
        "CVE-2016-1770",
        "CVE-2016-1773",
        "CVE-2016-1775",
        "CVE-2016-1788",
        "CVE-2016-1950"
      );
      script_bugtraq_id(
        71820,
        71994,
        75570,
        77390,
        77568,
        77681,
        78624,
        78626,
        79507,
        79509,
        79536,
        79562,
        80438,
        80695,
        80698
      );
      script_xref(name:"APPLE-SA", value:"APPLE-SA-2016-03-21-5");
    
      script_name(english:"Mac OS X 10.11.x < 10.11.4 Multiple Vulnerabilities");
      script_summary(english:"Checks the version of Mac OS X.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Mac OS X host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote host is running a version of Mac OS X that is 10.11.x prior
    to 10.11.4. It is, therefore, affected by multiple vulnerabilities in
    the following components :
    
      - apache_mod_php
      - AppleRAID
      - AppleUSBNetworking
      - Bluetooth
      - Carbon
      - dyld
      - FontParser
      - HTTPProtocol
      - Intel Graphics Driver
      - IOFireWireFamily
      - IOGraphics
      - IOHIDFamily
      - IOUSBFamily
      - Kernel
      - libxml2
      - Messages
      - NVIDIA Graphics Drivers
      - OpenSSH
      - OpenSSL
      - Python
      - QuickTime
      - Reminders
      - Ruby
      - Security
      - Tcl
      - TrueTypeScaler
      - Wi-Fi
    
    Note that successful exploitation of the most serious issues can
    result in arbitrary code execution.");
      script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT206167");
      # http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6c87f79a");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Mac OS X version 10.11.4 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-1761");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2014/12/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/03/21");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/03/22");
    
      script_set_attribute(attribute:"plugin_type", value:"combined");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl", "os_fingerprint.nasl");
      script_require_ports("Host/MacOSX/Version", "Host/OS");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    
    os = get_kb_item("Host/MacOSX/Version");
    if (!os)
    {
      os = get_kb_item_or_exit("Host/OS");
      if ("Mac OS X" >!< os)
        audit(AUDIT_OS_NOT, "Mac OS X");
    
      c = get_kb_item("Host/OS/Confidence");
      if (c <= 70)
        exit(1, "Cannot determine the host's OS with sufficient confidence.");
    }
    if (!os)
      audit(AUDIT_OS_NOT, "Mac OS X");
    
    match = eregmatch(pattern:"Mac OS X ([0-9]+(\.[0-9]+)+)", string:os);
    if (isnull(match)) exit(1, "Failed to parse the Mac OS X version ('" + os + "').");
    
    version = match[1];
    
    if (
      version !~ "^10\.11([^0-9]|$)"
    ) audit(AUDIT_OS_NOT, "Mac OS X 10.11 or later", "Mac OS X "+version);
    
    fix = "10.11.4";
    if (ver_compare(ver:version, fix:fix, strict:FALSE) == -1)
    {
      items = make_array("Installed version", version,
                         "Fixed version", fix
                        );
      order = make_list("Installed version", "Fixed version");
      report = report_items_str(report_items:items, ordered_fields:order);
    
      security_report_v4(port:0, extra:report, severity:SECURITY_HOLE);
      exit(0);
    
     }
    else
      audit(AUDIT_INST_VER_NOT_VULN, "Mac OS X", version);
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-2812-1.NASL
    descriptionFlorian Weimer discovered that libxml2 incorrectly handled certain XML data. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause resource consumption, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-1819) Michal Zalewski discovered that libxml2 incorrectly handled certain XML data. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-7941) Kostya Serebryany discovered that libxml2 incorrectly handled certain XML data. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-7942) Gustavo Grieco discovered that libxml2 incorrectly handled certain XML data. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-8035). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id86897
    published2015-11-17
    reporterUbuntu Security Notice (C) 2015-2019 Canonical, Inc. / NASL script (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86897
    titleUbuntu 12.04 LTS / 14.04 LTS / 15.04 / 15.10 : libxml2 vulnerabilities (USN-2812-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-2812-1. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(86897);
      script_version("2.10");
      script_cvs_date("Date: 2019/09/18 12:31:45");
    
      script_cve_id("CVE-2015-1819", "CVE-2015-7941", "CVE-2015-7942", "CVE-2015-8035");
      script_xref(name:"USN", value:"2812-1");
    
      script_name(english:"Ubuntu 12.04 LTS / 14.04 LTS / 15.04 / 15.10 : libxml2 vulnerabilities (USN-2812-1)");
      script_summary(english:"Checks dpkg output for updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Ubuntu host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Florian Weimer discovered that libxml2 incorrectly handled certain XML
    data. If a user or automated system were tricked into opening a
    specially crafted document, an attacker could possibly cause resource
    consumption, resulting in a denial of service. This issue only
    affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 15.04.
    (CVE-2015-1819)
    
    Michal Zalewski discovered that libxml2 incorrectly handled certain
    XML data. If a user or automated system were tricked into opening a
    specially crafted document, an attacker could possibly cause libxml2
    to crash, resulting in a denial of service. This issue only affected
    Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-7941)
    
    Kostya Serebryany discovered that libxml2 incorrectly handled certain
    XML data. If a user or automated system were tricked into opening a
    specially crafted document, an attacker could possibly cause libxml2
    to crash, resulting in a denial of service, or possibly execute
    arbitrary code. (CVE-2015-7942)
    
    Gustavo Grieco discovered that libxml2 incorrectly handled certain XML
    data. If a user or automated system were tricked into opening a
    specially crafted document, an attacker could possibly cause libxml2
    to crash, resulting in a denial of service. This issue only affected
    Ubuntu 14.04 LTS. (CVE-2015-8035).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/2812-1/"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected libxml2 package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libxml2");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.04:-:lts");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:15.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:15.10");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2015/08/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/11/16");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/11/17");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2015-2019 Canonical, Inc. / NASL script (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! preg(pattern:"^(12\.04|14\.04|15\.04|15\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 12.04 / 14.04 / 15.04 / 15.10", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"12.04", pkgname:"libxml2", pkgver:"2.7.8.dfsg-5.1ubuntu4.12")) flag++;
    if (ubuntu_check(osver:"14.04", pkgname:"libxml2", pkgver:"2.9.1+dfsg1-3ubuntu4.5")) flag++;
    if (ubuntu_check(osver:"15.04", pkgname:"libxml2", pkgver:"2.9.2+dfsg1-3ubuntu0.1")) flag++;
    if (ubuntu_check(osver:"15.10", pkgname:"libxml2", pkgver:"2.9.2+zdfsg1-4ubuntu0.1")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxml2");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-32.NASL
    description - security update: This update fixes the following security issues : - CVE-2015-1819 Enforce the reader to run in constant memory [bnc#928193] - CVE-2015-7941 Fix out of bound read with crafted xml input by stopping parsing on entities boundaries errors [bnc#951734] - CVE-2015-7942 Fix another variation of overflow in Conditional sections [bnc#951735] - CVE-2015-8241 Avoid extra processing of MarkupDecl when EOF [bnc#956018] - CVE-2015-8242 Buffer overead with HTML parser in push mode [bnc#956021] - CVE-2015-8317 Return if the encoding declaration is broken or encoding conversion failed [bnc#956260] - CVE-2015-5312 Fix another entity expansion issue [bnc#957105] - CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey [bnc#957106] - CVE-2015-7498 Processes entities after encoding conversion failures [bnc#957107] - CVE-2015-7499 Add xmlHaltParser() to stop the parser / Detect incoherency on GROW [bnc#957109] - CVE-2015-8317 Multiple out-of-bound read could lead to denial of service [bnc#956260] - CVE-2015-8035 DoS when parsing specially crafted XML document if XZ support is enabled [bnc#954429] - CVE-2015-7500 Fix memory access error due to incorrect entities boundaries [bnc#957110] This update was imported from the SUSE:SLE-12:Update update project.
    last seen2020-06-05
    modified2016-01-25
    plugin id88122
    published2016-01-25
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/88122
    titleopenSUSE Security Update : libxml2 (openSUSE-2016-32)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2016-32.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(88122);
      script_version("2.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2015-1819", "CVE-2015-5312", "CVE-2015-7497", "CVE-2015-7498", "CVE-2015-7499", "CVE-2015-7500", "CVE-2015-7941", "CVE-2015-7942", "CVE-2015-8035", "CVE-2015-8241", "CVE-2015-8242", "CVE-2015-8317");
    
      script_name(english:"openSUSE Security Update : libxml2 (openSUSE-2016-32)");
      script_summary(english:"Check for the openSUSE-2016-32 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "  - security update: This update fixes the following
        security issues :
    
      - CVE-2015-1819 Enforce the reader to run in constant
        memory [bnc#928193]
    
      - CVE-2015-7941 Fix out of bound read with crafted xml
        input by stopping parsing on entities boundaries errors
        [bnc#951734]
    
      - CVE-2015-7942 Fix another variation of overflow in
        Conditional sections [bnc#951735]
    
      - CVE-2015-8241 Avoid extra processing of MarkupDecl when
        EOF [bnc#956018]
    
      - CVE-2015-8242 Buffer overead with HTML parser in push
        mode [bnc#956021]
    
      - CVE-2015-8317 Return if the encoding declaration is
        broken or encoding conversion failed [bnc#956260]
    
      - CVE-2015-5312 Fix another entity expansion issue
        [bnc#957105]
    
      - CVE-2015-7497 Avoid an heap buffer overflow in
        xmlDictComputeFastQKey [bnc#957106]
    
      - CVE-2015-7498 Processes entities after encoding
        conversion failures [bnc#957107]
    
      - CVE-2015-7499 Add xmlHaltParser() to stop the parser /
        Detect incoherency on GROW [bnc#957109]
    
      - CVE-2015-8317 Multiple out-of-bound read could lead to
        denial of service [bnc#956260]
    
      - CVE-2015-8035 DoS when parsing specially crafted XML
        document if XZ support is enabled [bnc#954429]
    
      - CVE-2015-7500 Fix memory access error due to incorrect
        entities boundaries [bnc#957110] This update was
        imported from the SUSE:SLE-12:Update update project."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=928193"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=951734"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=951735"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=954429"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=956018"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=956021"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=956260"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=957105"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=957106"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=957107"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=957109"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=957110"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected libxml2 packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxml2-2");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxml2-2-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxml2-2-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxml2-2-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxml2-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxml2-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxml2-devel-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxml2-tools");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxml2-tools-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-libxml2");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-libxml2-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:python-libxml2-debugsource");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2016/01/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/01/25");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE42\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "42.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE42.1", reference:"libxml2-2-2.9.1-10.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"libxml2-2-debuginfo-2.9.1-10.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"libxml2-debugsource-2.9.1-10.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"libxml2-devel-2.9.1-10.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"libxml2-tools-2.9.1-10.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"libxml2-tools-debuginfo-2.9.1-10.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"python-libxml2-2.9.1-10.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"python-libxml2-debuginfo-2.9.1-10.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"python-libxml2-debugsource-2.9.1-10.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libxml2-2-32bit-2.9.1-10.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libxml2-2-debuginfo-32bit-2.9.1-10.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"libxml2-devel-32bit-2.9.1-10.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxml2-2 / libxml2-2-32bit / libxml2-2-debuginfo / etc");
    }
    
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20151207_LIBXML2_ON_SL7_X.NASL
    descriptionSeveral denial of service flaws were found in libxml2, a library providing support for reading, modifying, and writing XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially sensitive information, or in certain cases crash the application. (CVE-2015-1819, CVE-2015-5312, CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500 CVE-2015-7941, CVE-2015-7942, CVE-2015-8241, CVE-2015-8242, CVE-2015-8317, BZ#1213957, BZ#1281955) The desktop must be restarted (log out, then log back in) for this update to take effect.
    last seen2020-04-16
    modified2015-12-22
    plugin id87581
    published2015-12-22
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87581
    titleScientific Linux Security Update : libxml2 on SL7.x x86_64 (20151207)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text is (C) Scientific Linux.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(87581);
      script_version("2.5");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/15");
    
      script_cve_id("CVE-2015-1819", "CVE-2015-5312", "CVE-2015-7497", "CVE-2015-7498", "CVE-2015-7499", "CVE-2015-7500", "CVE-2015-7941", "CVE-2015-7942", "CVE-2015-8241", "CVE-2015-8242", "CVE-2015-8317");
    
      script_name(english:"Scientific Linux Security Update : libxml2 on SL7.x x86_64 (20151207)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Scientific Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Several denial of service flaws were found in libxml2, a library
    providing support for reading, modifying, and writing XML and HTML
    files. A remote attacker could provide a specially crafted XML or HTML
    file that, when processed by an application using libxml2, would cause
    that application to use an excessive amount of CPU, leak potentially
    sensitive information, or in certain cases crash the application.
    (CVE-2015-1819, CVE-2015-5312, CVE-2015-7497, CVE-2015-7498,
    CVE-2015-7499, CVE-2015-7500 CVE-2015-7941, CVE-2015-7942,
    CVE-2015-8241, CVE-2015-8242, CVE-2015-8317, BZ#1213957, BZ#1281955)
    
    The desktop must be restarted (log out, then log back in) for this
    update to take effect."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1213957"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1281955"
      );
      # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1512&L=scientific-linux-errata&F=&S=&P=17295
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?930c9f89"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2015-5312");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libxml2");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libxml2-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libxml2-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libxml2-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libxml2-static");
      script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2015/08/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/12/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/12/22");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Scientific Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux");
    os_ver = pregmatch(pattern: "Scientific Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Scientific Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Scientific Linux 7.x", "Scientific Linux " + os_ver);
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu);
    if ("x86_64" >!< cpu) audit(AUDIT_ARCH_NOT, "x86_64", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"libxml2-2.9.1-6.el7_2.2", el_string:"el7_2")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"libxml2-debuginfo-2.9.1-6.el7_2.2", el_string:"el7_2")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"libxml2-devel-2.9.1-6.el7_2.2", el_string:"el7_2")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"libxml2-python-2.9.1-6.el7_2.2", el_string:"el7_2")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"libxml2-static-2.9.1-6.el7_2.2", el_string:"el7_2")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxml2 / libxml2-debuginfo / libxml2-devel / libxml2-python / etc");
    }
    
  • NASL familyAIX Local Security Checks
    NASL idAIX_U870330.NASL
    descriptionThe remote host is missing AIX PTF U870330, which is related to the security of the package bos.rte.control. Libxml2 is vulnerable to a denial of service, caused by a heap-based buffer overflow in the xmlParseEntityDecl or xmlParseConditionalSections function. By using a specially crafted XML data, a remote attacker could exploit this vulnerability to trigger an out-of-bounds read and cause the system to crash. Libxml2 is vulnerable to a denial of service, caused by a heap-based buffer overflow in the xmlParseConditionalSections function. By using a specially crafted XML data, a remote attacker could exploit this vulnerability to trigger an out-of-bounds read and cause the system to crash. libxml2 is vulnerable to a buffer overflow, caused by improper bounds checking by the XML parser in xmlNextChar. By using a malformed XML file, a local attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
    last seen2020-06-01
    modified2020-06-02
    plugin id91237
    published2016-05-19
    reporterThis script is Copyright (C) 2016 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/91237
    titleAIX 7.2 : bos.rte.control (U870330)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were extracted
    # from AIX Security PTF U870330. The text itself is copyright (C)
    # International Business Machines Corp.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(91237);
      script_version("$Revision: 2.1 $");
      script_cvs_date("$Date: 2016/05/19 18:10:51 $");
    
      script_cve_id("CVE-2015-7941", "CVE-2015-7942", "CVE-2015-8241");
    
      script_name(english:"AIX 7.2 : bos.rte.control (U870330)");
      script_summary(english:"Check for PTF U870330");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote AIX host is missing a vendor-supplied security patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is missing AIX PTF U870330, which is related to the
    security of the package bos.rte.control.
    
    Libxml2 is vulnerable to a denial of service, caused by a heap-based
    buffer overflow in the xmlParseEntityDecl or
    xmlParseConditionalSections function. By using a specially crafted XML
    data, a remote attacker could exploit this vulnerability to trigger an
    out-of-bounds read and cause the system to crash. Libxml2 is
    vulnerable to a denial of service, caused by a heap-based buffer
    overflow in the xmlParseConditionalSections function. By using a
    specially crafted XML data, a remote attacker could exploit this
    vulnerability to trigger an out-of-bounds read and cause the system to
    crash. libxml2 is vulnerable to a buffer overflow, caused by improper
    bounds checking by the XML parser in xmlNextChar. By using a malformed
    XML file, a local attacker could overflow a buffer and execute
    arbitrary code on the system or cause the application to crash."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www-01.ibm.com/support/docview.wss?uid=isg1IV80616"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Install the appropriate missing security-related fix."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:ibm:aix:7.2");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/01/20");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/01/20");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/05/19");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016 Tenable Network Security, Inc.");
      script_family(english:"AIX Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/AIX/oslevel", "Host/AIX/version", "Host/AIX/lslpp");
    
      exit(0);
    }
    
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("aix.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if ( ! get_kb_item("Host/AIX/version") ) audit(AUDIT_OS_NOT, "AIX");
    if ( ! get_kb_item("Host/AIX/lslpp") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    flag = 0;
    
    if ( aix_check_patch(ml:"720000", patch:"U870330", package:"bos.rte.control.7.2.0.1") < 0 ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:aix_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2015-2549.NASL
    descriptionFrom Red Hat Security Advisory 2015:2549 : Updated libxml2 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The libxml2 library is a development toolbox providing the implementation of various XML standards. Several denial of service flaws were found in libxml2, a library providing support for reading, modifying, and writing XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially sensitive information, or in certain cases crash the application. (CVE-2015-5312, CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500 CVE-2015-7941, CVE-2015-7942, CVE-2015-8241, CVE-2015-8242, CVE-2015-8317, BZ#1213957, BZ#1281955) Red Hat would like to thank the GNOME project for reporting CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500, CVE-2015-8241, CVE-2015-8242, and CVE-2015-8317. Upstream acknowledges Kostya Serebryany of Google as the original reporter of CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, and CVE-2015-7500; Hugh Davenport as the original reporter of CVE-2015-8241 and CVE-2015-8242; and Hanno Boeck as the original reporter of CVE-2015-8317. All libxml2 users are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. The desktop must be restarted (log out, then log back in) for this update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id87230
    published2015-12-08
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87230
    titleOracle Linux 6 : libxml2 (ELSA-2015-2549)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201701-37.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201701-37 (libxml2: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in libxml2. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user or automated system to process a specially crafted XML document, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id96541
    published2017-01-17
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96541
    titleGLSA-201701-37 : libxml2: Multiple vulnerabilities
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20151207_LIBXML2_ON_SL6_X.NASL
    descriptionSeveral denial of service flaws were found in libxml2, a library providing support for reading, modifying, and writing XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially sensitive information, or in certain cases crash the application. (CVE-2015-5312, CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500 CVE-2015-7941, CVE-2015-7942, CVE-2015-8241, CVE-2015-8242, CVE-2015-8317, BZ#1213957, BZ#1281955) The desktop must be restarted (log out, then log back in) for this update to take effect.
    last seen2020-04-16
    modified2015-12-08
    plugin id87235
    published2015-12-08
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87235
    titleScientific Linux Security Update : libxml2 on SL6.x i386/x86_64 (20151207)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2015-2549.NASL
    descriptionUpdated libxml2 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The libxml2 library is a development toolbox providing the implementation of various XML standards. Several denial of service flaws were found in libxml2, a library providing support for reading, modifying, and writing XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially sensitive information, or in certain cases crash the application. (CVE-2015-5312, CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500 CVE-2015-7941, CVE-2015-7942, CVE-2015-8241, CVE-2015-8242, CVE-2015-8317, BZ#1213957, BZ#1281955) Red Hat would like to thank the GNOME project for reporting CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500, CVE-2015-8241, CVE-2015-8242, and CVE-2015-8317. Upstream acknowledges Kostya Serebryany of Google as the original reporter of CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, and CVE-2015-7500; Hugh Davenport as the original reporter of CVE-2015-8241 and CVE-2015-8242; and Hanno Boeck as the original reporter of CVE-2015-8317. All libxml2 users are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. The desktop must be restarted (log out, then log back in) for this update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id87233
    published2015-12-08
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87233
    titleRHEL 6 : libxml2 (RHSA-2015:2549)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2015-2550.NASL
    descriptionFrom Red Hat Security Advisory 2015:2550 : Updated libxml2 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The libxml2 library is a development toolbox providing the implementation of various XML standards. Several denial of service flaws were found in libxml2, a library providing support for reading, modifying, and writing XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially sensitive information, or in certain cases crash the application. (CVE-2015-1819, CVE-2015-5312, CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500 CVE-2015-7941, CVE-2015-7942, CVE-2015-8241, CVE-2015-8242, CVE-2015-8317, BZ#1213957, BZ#1281955) Red Hat would like to thank the GNOME project for reporting CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500, CVE-2015-8241, CVE-2015-8242, and CVE-2015-8317. Upstream acknowledges Kostya Serebryany of Google as the original reporter of CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, and CVE-2015-7500; Hugh Davenport as the original reporter of CVE-2015-8241 and CVE-2015-8242; and Hanno Boeck as the original reporter of CVE-2015-8317. The CVE-2015-1819 issue was discovered by Florian Weimer of Red Hat Product Security. All libxml2 users are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. The desktop must be restarted (log out, then log back in) for this update to take effect.
    last seen2020-04-16
    modified2015-12-08
    plugin id87231
    published2015-12-08
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87231
    titleOracle Linux 7 : libxml2 (ELSA-2015-2550)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2015-2550.NASL
    descriptionUpdated libxml2 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The libxml2 library is a development toolbox providing the implementation of various XML standards. Several denial of service flaws were found in libxml2, a library providing support for reading, modifying, and writing XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially sensitive information, or in certain cases crash the application. (CVE-2015-1819, CVE-2015-5312, CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500 CVE-2015-7941, CVE-2015-7942, CVE-2015-8241, CVE-2015-8242, CVE-2015-8317, BZ#1213957, BZ#1281955) Red Hat would like to thank the GNOME project for reporting CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500, CVE-2015-8241, CVE-2015-8242, and CVE-2015-8317. Upstream acknowledges Kostya Serebryany of Google as the original reporter of CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, and CVE-2015-7500; Hugh Davenport as the original reporter of CVE-2015-8241 and CVE-2015-8242; and Hanno Boeck as the original reporter of CVE-2015-8317. The CVE-2015-1819 issue was discovered by Florian Weimer of Red Hat Product Security. All libxml2 users are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. The desktop must be restarted (log out, then log back in) for this update to take effect.
    last seen2020-04-10
    modified2015-12-08
    plugin id87234
    published2015-12-08
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87234
    titleRHEL 7 : libxml2 (RHSA-2015:2550)
  • NASL familyOracleVM Local Security Checks
    NASL idORACLEVM_OVMSA-2015-0152.NASL
    descriptionThe remote OracleVM system is missing necessary patches to address critical security updates : - Update doc/redhat.gif in tarball - Add libxml2-oracle-enterprise.patch and update logos in tarball - Fix a series of CVEs (rhbz#1286495) - CVE-2015-7941 Cleanup conditional section error handling - CVE-2015-8317 Fail parsing early on if encoding conversion failed - CVE-2015-7942 Another variation of overflow in Conditional sections - CVE-2015-7942 Fix an error in previous Conditional section patch - Fix parsing short unclosed comment uninitialized access - CVE-2015-7498 Avoid processing entities after encoding conversion failures - CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey - CVE-2015-5312 Another entity expansion issue - CVE-2015-7499 Add xmlHaltParser to stop the parser - CVE-2015-7499 Detect incoherency on GROW - CVE-2015-7500 Fix memory access error due to incorrect entities boundaries - CVE-2015-8242 Buffer overead with HTML parser in push mode - Libxml violates the zlib interface and crashes
    last seen2020-06-01
    modified2020-06-02
    plugin id87232
    published2015-12-08
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87232
    titleOracleVM 3.3 : libxml2 (OVMSA-2015-0152)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2015-037F844D3E.NASL
    descriptionVery large set of security issues for libxml2 and a bunch of bug fixes too#CVE-2015-8242 #CVE-2015-7500 #CVE-2015-7499 #CVE-2015-5312 #CVE-2015-7498 #CVE-2015-7497 #CVE-2015-1819 #CVE-2015-7941 #CVE-2015-7942 #CVE-2015-8035 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-03-04
    plugin id89130
    published2016-03-04
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/89130
    titleFedora 22 : libxml2-2.9.3-1.fc22 (2015-037f844d3e)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-A9EE80B01D.NASL
    descriptionUpdate to 2.9.3 which fixes various CVE
    last seen2020-06-05
    modified2016-03-04
    plugin id89591
    published2016-03-04
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/89591
    titleFedora 22 : mingw-libxml2-2.9.3-1.fc22 (2016-a9ee80b01d)
  • NASL familyAIX Local Security Checks
    NASL idAIX_IV80617.NASL
    descriptionThe remote AIX host has a version of libxml2 installed that is affected by the following vulnerabilities : - A heap-based buffer overflow condition exists in the xmlParseEntityDecl() and xmlParseConditionalSections() functions within file parser.c due to a failure to properly stop parsing invalid input. An unauthenticated, remote attacker can exploit this, via specially crafted XML data, to cause a denial of service condition or potentially disclose sensitive memory contents. (CVE-2015-7941) - A heap-based buffer overflow condition exists in the xmlParseConditionalSections() function within file parser.c due to not properly skipping intermediary entities. An unauthenticated, remote attacker can exploit this, via specially crafted XML data, to cause a denial of service condition. (CVE-2015-7942) - A buffer overflow condition exists in the xmlNextChar() function due to improper bounds checking. A local attacker can exploit this, via a malformed XML file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2015-8241)
    last seen2020-06-01
    modified2020-06-02
    plugin id88885
    published2016-02-23
    reporterThis script is Copyright (C) 2016-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/88885
    titleAIX 5.3 TL 12 : libxml2 (IV80617)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2015-2549.NASL
    descriptionUpdated libxml2 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The libxml2 library is a development toolbox providing the implementation of various XML standards. Several denial of service flaws were found in libxml2, a library providing support for reading, modifying, and writing XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially sensitive information, or in certain cases crash the application. (CVE-2015-5312, CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500 CVE-2015-7941, CVE-2015-7942, CVE-2015-8241, CVE-2015-8242, CVE-2015-8317, BZ#1213957, BZ#1281955) Red Hat would like to thank the GNOME project for reporting CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500, CVE-2015-8241, CVE-2015-8242, and CVE-2015-8317. Upstream acknowledges Kostya Serebryany of Google as the original reporter of CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, and CVE-2015-7500; Hugh Davenport as the original reporter of CVE-2015-8241 and CVE-2015-8242; and Hanno Boeck as the original reporter of CVE-2015-8317. All libxml2 users are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. The desktop must be restarted (log out, then log back in) for this update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id87223
    published2015-12-08
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87223
    titleCentOS 6 : libxml2 (CESA-2015:2549)
  • NASL familyAIX Local Security Checks
    NASL idAIX_IV80588.NASL
    descriptionThe remote AIX host has a version of libxml2 installed that is affected by the following vulnerabilities : - A heap-based buffer overflow condition exists in the xmlParseEntityDecl() and xmlParseConditionalSections() functions within file parser.c due to a failure to properly stop parsing invalid input. An unauthenticated, remote attacker can exploit this, via specially crafted XML data, to cause a denial of service condition or potentially disclose sensitive memory contents. (CVE-2015-7941) - A heap-based buffer overflow condition exists in the xmlParseConditionalSections() function within file parser.c due to not properly skipping intermediary entities. An unauthenticated, remote attacker can exploit this, via specially crafted XML data, to cause a denial of service condition. (CVE-2015-7942) - A buffer overflow condition exists in the xmlNextChar() function due to improper bounds checking. A local attacker can exploit this, via a malformed XML file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2015-8241)
    last seen2020-06-01
    modified2020-06-02
    plugin id88883
    published2016-02-23
    reporterThis script is Copyright (C) 2016-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/88883
    titleAIX 6.1 TL 9 : libxml2 (IV80588)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-355.NASL
    descriptionCVE-2015-8241 Buffer overread with XML parser in xmlNextChar CVE-2015-8317 - issues in the xmlParseXMLDecl function: If we fail conversing the current input stream while processing the encoding declaration of the XMLDecl then it
    last seen2020-03-17
    modified2015-11-30
    plugin id87076
    published2015-11-30
    reporterThis script is Copyright (C) 2015-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/87076
    titleDebian DLA-355-1 : libxml2 security update
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-0049-1.NASL
    description - security update: This update fixes the following security issues : - CVE-2015-1819 Enforce the reader to run in constant memory [bnc#928193] - CVE-2015-7941 Fix out of bound read with crafted xml input by stopping parsing on entities boundaries errors [bnc#951734] - CVE-2015-7942 Fix another variation of overflow in Conditional sections [bnc#951735] - CVE-2015-8241 Avoid extra processing of MarkupDecl when EOF [bnc#956018] - CVE-2015-8242 Buffer overead with HTML parser in push mode [bnc#956021] - CVE-2015-8317 Return if the encoding declaration is broken or encoding conversion failed [bnc#956260] - CVE-2015-5312 Fix another entity expansion issue [bnc#957105] - CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey [bnc#957106] - CVE-2015-7498 Processes entities after encoding conversion failures [bnc#957107] - CVE-2015-7499 Add xmlHaltParser() to stop the parser / Detect incoherency on GROW [bnc#957109] - CVE-2015-8317 Multiple out-of-bound read could lead to denial of service [bnc#956260] - CVE-2015-8035 DoS when parsing specially crafted XML document if XZ support is enabled [bnc#954429] - CVE-2015-7500 Fix memory access error due to incorrect entities boundaries [bnc#957110] Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id87865
    published2016-01-12
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87865
    titleSUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2016:0049-1)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2015-C24AF963A2.NASL
    descriptionVery large set of security issues for libxml2 and a bunch of bug fixes too#CVE-2015-8242 #CVE-2015-7500 #CVE-2015-7499 #CVE-2015-5312 #CVE-2015-7498 #CVE-2015-7497 #CVE-2015-1819 #CVE-2015-7941 #CVE-2015-7942 #CVE-2015-8035 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-03-04
    plugin id89394
    published2016-03-04
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/89394
    titleFedora 23 : libxml2-2.9.3-1.fc23 (2015-c24af963a2)
  • NASL familyAIX Local Security Checks
    NASL idAIX_IV80616.NASL
    descriptionThe remote AIX host has a version of libxml2 installed that is affected by the following vulnerabilities : - A heap-based buffer overflow condition exists in the xmlParseEntityDecl() and xmlParseConditionalSections() functions within file parser.c due to a failure to properly stop parsing invalid input. An unauthenticated, remote attacker can exploit this, via specially crafted XML data, to cause a denial of service condition or potentially disclose sensitive memory contents. (CVE-2015-7941) - A heap-based buffer overflow condition exists in the xmlParseConditionalSections() function within file parser.c due to not properly skipping intermediary entities. An unauthenticated, remote attacker can exploit this, via specially crafted XML data, to cause a denial of service condition. (CVE-2015-7942) - A buffer overflow condition exists in the xmlNextChar() function due to improper bounds checking. A local attacker can exploit this, via a malformed XML file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2015-8241)
    last seen2020-06-01
    modified2020-06-02
    plugin id88884
    published2016-02-23
    reporterThis script is Copyright (C) 2016-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/88884
    titleAIX 7.2 TL 0 : libxml2 (IV80616)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3430.NASL
    descriptionSeveral vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially sensitive information, or crash the application.
    last seen2020-06-01
    modified2020-06-02
    plugin id87608
    published2015-12-29
    reporterThis script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87608
    titleDebian DSA-3430-1 : libxml2 - security update
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2015-628.NASL
    descriptionA denial of service flaw was found in the way the libxml2 library parsed certain XML files. An attacker could provide a specially crafted XML file that, when parsed by an application using libxml2, could cause that application to use an excessive amount of memory. The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941 . libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities. A heap-based buffer overflow vulnerability was found in xmlDictComputeFastQKey in dict.c. A heap-based buffer overflow read in xmlParseMisc was found. A heap-based buffer overflow was found in xmlGROW allowing the attacker to read the memory out of bounds. A buffer overread in xmlNextChar was found, causing segmentation fault when compiled with ASAN. Heap-based buffer overflow was found in xmlParseXmlDecl. When conversion failure happens, parser continues to extract more errors which may lead to unexpected behaviour. Stack-based buffer overread vulnerability with HTML parser in push mode in xmlSAX2TextNode causing segmentation fault when compiled with ASAN. A vulnerability in libxml2 was found causing DoS by exhausting CPU when parsing specially crafted XML document. An out-of-bounds heap read in xmlParseXMLDecl happens when a file containing unfinished xml declaration.
    last seen2020-06-01
    modified2020-06-02
    plugin id87354
    published2015-12-15
    reporterThis script is Copyright (C) 2015-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/87354
    titleAmazon Linux AMI : libxml2 (ALAS-2015-628)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD2016-002.NASL
    descriptionThe remote host is running a version of Mac OS X that is 10.9.5 or 10.10.5 and is missing Security Update 2016-002. It is, therefore, affected by multiple vulnerabilities in the following components : - apache_mod_php - Kernel - libxml2 - OpenSSH - Python - Tcl Note that successful exploitation of the most serious issues can result in arbitrary code execution.
    last seen2020-06-01
    modified2020-06-02
    plugin id90097
    published2016-03-22
    reporterThis script is Copyright (C) 2016-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/90097
    titleMac OS X 10.9.5 / 10.10.5 Multiple Vulnerabilities (Security Update 2016-002)

Redhat

advisories
  • rhsa
    idRHSA-2015:2549
  • rhsa
    idRHSA-2015:2550
  • rhsa
    idRHSA-2016:1089
rpms
  • libxml2-0:2.7.6-20.el6_7.1
  • libxml2-debuginfo-0:2.7.6-20.el6_7.1
  • libxml2-devel-0:2.7.6-20.el6_7.1
  • libxml2-python-0:2.7.6-20.el6_7.1
  • libxml2-static-0:2.7.6-20.el6_7.1
  • libxml2-0:2.9.1-6.el7_2.2
  • libxml2-debuginfo-0:2.9.1-6.el7_2.2
  • libxml2-devel-0:2.9.1-6.el7_2.2
  • libxml2-python-0:2.9.1-6.el7_2.2
  • libxml2-static-0:2.9.1-6.el7_2.2

References