Vulnerabilities > CVE-2019-18197 - Use of Uninitialized Resource vulnerability in multiple products

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
high complexity
xmlsoft
debian
canonical
CWE-908
nessus

Summary

In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed.

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyWindows
    NASL idORACLE_JAVA_CPU_APR_2020.NASL
    descriptionThe version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 7 Update 261, 8 Update 251, 11 Update 7, or 14 Update 1. It is, therefore, affected by multiple vulnerabilities related to the following components : - Oracle Java SE and Java SE Embedded are prone to a buffer overflow attack, over
    last seen2020-04-23
    modified2020-04-16
    plugin id135592
    published2020-04-16
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135592
    titleOracle Java SE 1.7.0_261 / 1.8.0_251 / 1.11.0_7 / 1.14.0_1 Multiple Vulnerabilities (Apr 2020 CPU)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include('compat.inc');
    
    if (description)
    {
      script_id(135592);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/07/17");
    
      script_cve_id(
        "CVE-2019-18197",
        "CVE-2020-2754",
        "CVE-2020-2755",
        "CVE-2020-2756",
        "CVE-2020-2757",
        "CVE-2020-2764",
        "CVE-2020-2767",
        "CVE-2020-2773",
        "CVE-2020-2778",
        "CVE-2020-2781",
        "CVE-2020-2800",
        "CVE-2020-2803",
        "CVE-2020-2805",
        "CVE-2020-2816",
        "CVE-2020-2830"
      );
      script_xref(name:"IAVA", value:"2020-A-0134-S");
    
      script_name(english:"Oracle Java SE 1.7.0_261 / 1.8.0_251 / 1.11.0_7 / 1.14.0_1 Multiple Vulnerabilities (Apr 2020 CPU)");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote host is affected by multiple vulnerabilities");
      script_set_attribute(attribute:"description", value:
    "The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 7 Update
    261, 8 Update 251, 11 Update 7, or 14 Update 1. It is, therefore, affected by multiple vulnerabilities related to the
    following components :
    
      - Oracle Java SE and Java SE Embedded are prone to a buffer overflow attack, over 'Multiple' protocol.
        This issue affects the 'JavaFX (libxslt)' component. Successful attacks of this vulnerability allow 
        unauthenticated attacker with network access to takeover of Java SE. (CVE-2019-18197)
    
      - Oracle Java SE and Java SE Embedded are prone to partial denial of service (partial DOS) vulnerability.
        An unauthenticated remote attacker can exploit this over 'Multiple' protocol. This issue affects the
        'Scripting' component. (CVE-2020-2754, CVE-2020-2755)
    
      - Oracle Java SE and Java SE Embedded are prone to partial denial of service (partial DOS) vulnerability.
        An unauthenticated remote attacker can exploit this over 'Multiple' protocol. This issue affects the
        'Serialization' component. (CVE-2020-2756, CVE-2020-2757)
    
      - Oracle Java SE prone to unauthorized read access vulnerability. An unauthenticated remote attacker can
        exploit this over 'Multiple' protocol can result in unauthorized read access to a subset of Java SE
        accessible data. This issue affects the 'Advanced Management Console' component. (CVE-2020-2764)
    
      - Oracle Java SE and Java SE Embedded are prone to unauthorized write/read access vulnerability. An
        unauthenticated remote attacker over 'HTTPS' can read, update, insert or delete access to some of Java SE
        accessible data. This issue affects the 'JSSE' component. (CVE-2020-2767)
    
      - Oracle Java SE and Java SE Embedded are prone to partial denial of service (partial DOS) vulnerability.
        An unauthenticated remote attacker can exploit this over 'Multiple' protocol. This issue affects the
        'Scripting' component. (CVE-2020-2773)
    
    It is also affected by other vulnerabilities; please see vendor advisories for more information.
    
    Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
    number.");
      script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/a/tech/docs/cpuapr2020cvrf.xml");
      script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/security-alerts/cpuapr2020.html");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Oracle JDK / JRE 14 Update 1 , 11 Update 7, 8 Update 251 , 7 Update 261 or later.
    If necessary, remove any affected versions.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-2800");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2020/04/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/04/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/04/16");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:jre");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:jdk");
      script_set_attribute(attribute:"stig_severity", value:"I");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("sun_java_jre_installed.nasl");
      script_require_keys("SMB/Java/JRE/Installed");
    
      exit(0);
    }
    
    include('audit.inc');
    include('global_settings.inc');
    include('misc_func.inc');
    
    # Check each installed JRE.
    installs = get_kb_list_or_exit("SMB/Java/JRE/*");
    
    info = "";
    vuln = 0;
    installed_versions = "";
    
    foreach install (list_uniq(keys(installs)))
    {
      ver = install - "SMB/Java/JRE/";
      if (ver !~ "^[0-9.]+") continue;
    
      installed_versions = installed_versions + " & " + ver;
    
      # Fixes : (JDK|JRE) 13 Update 2 / 11 Update 6 / 8 Update 214 / 7 Update 251 
      if (
        ver_compare(minver:"1.7.0", ver:ver, fix:"1.7.0_261", regexes:{0:"_(\d+)"}, strict:FALSE) < 0 ||
        ver_compare(minver:"1.8.0", ver:ver, fix:"1.8.0_251", regexes:{0:"_(\d+)"}, strict:FALSE) < 0 ||
        ver_compare(minver:"1.11.0", ver:ver, fix:"1.11.0_7", regexes:{0:"_(\d+)"}, strict:FALSE) < 0 ||
        ver_compare(minver:"1.13.0", ver:ver, fix:"1.14.0_1", regexes:{0:"_(\d+)"}, strict:FALSE) < 0 
    
      )
      {
        dirs = make_list(get_kb_list(install));
        vuln += max_index(dirs);
    
        foreach dir (dirs)
          info += '\n  Path              : ' + dir;
    
        info += '\n  Installed version : ' + ver;
        info += '\n  Fixed version     : 1.7.0_261 / 1.8.0_251 / 1.11.0_7 / 1.14.0_1\n';
      }
    }
    
    # Report if any were found to be vulnerable.
    if (info)
    {
      port = get_kb_item("SMB/transport");
      if (!port) port = 445;
    
      if (vuln > 1) s = "s of Java are";
      else s = " of Java is";
    
      report =
        '\n' +
        'The following vulnerable instance'+s+' installed on the\n' +
        'remote host :\n' +
        info;
      security_report_v4(severity:SECURITY_WARNING, port:port, extra:report);
    }
    else
    {
      installed_versions = substr(installed_versions, 3);
      if (" & " >< installed_versions)
        exit(0, "The Java "+installed_versions+" installations on the remote host are not affected.");
      else
        audit(AUDIT_INST_VER_NOT_VULN, "Java", installed_versions);
    }
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2627.NASL
    descriptionAccording to the versions of the libxslt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not check if the parent node is an element, which allows attackers to cause a denial of service via a crafted XML file, related to a
    last seen2020-05-08
    modified2019-12-18
    plugin id132162
    published2019-12-18
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132162
    titleEulerOS 2.0 SP3 : libxslt (EulerOS-SA-2019-2627)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(132162);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/07");
    
      script_cve_id(
        "CVE-2015-7995",
        "CVE-2016-1683",
        "CVE-2016-1684",
        "CVE-2016-4607",
        "CVE-2016-4608",
        "CVE-2016-4609",
        "CVE-2016-4610",
        "CVE-2019-18197"
      );
    
      script_name(english:"EulerOS 2.0 SP3 : libxslt (EulerOS-SA-2019-2627)");
      script_summary(english:"Checks the rpm output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS host is missing multiple security updates.");
      script_set_attribute(attribute:"description", value:
    "According to the versions of the libxslt packages installed, the
    EulerOS installation on the remote host is affected by the following
    vulnerabilities :
    
      - The xsltStylePreCompute function in preproc.c in
        libxslt 1.1.28 does not check if the parent node is an
        element, which allows attackers to cause a denial of
        service via a crafted XML file, related to a 'type
        confusion' issue.(CVE-2015-7995)
    
      - numbers.c in libxslt before 1.1.29, as used in Google
        Chrome before 51.0.2704.63, mishandles namespace nodes,
        which allows remote attackers to cause a denial of
        service (out-of-bounds heap memory access) or possibly
        have unspecified other impact via a crafted
        document.(CVE-2016-1683)
    
      - numbers.c in libxslt before 1.1.29, as used in Google
        Chrome before 51.0.2704.63, mishandles the i format
        token for xsl:number data, which allows remote
        attackers to cause a denial of service (integer
        overflow or resource consumption) or possibly have
        unspecified other impact via a crafted
        document.(CVE-2016-1684)
    
      - libxslt in Apple iOS before 9.3.3, OS X before 10.11.6,
        iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on
        Windows, tvOS before 9.2.2, and watchOS before 2.2.2
        allows remote attackers to cause a denial of service
        (memory corruption) or possibly have unspecified other
        impact via unknown vectors, a different vulnerability
        than CVE-2016-4608, CVE-2016-4609, CVE-2016-4610, and
        CVE-2016-4612.(CVE-2016-4607)
    
      - libxslt in Apple iOS before 9.3.3, OS X before 10.11.6,
        iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on
        Windows, tvOS before 9.2.2, and watchOS before 2.2.2
        allows remote attackers to cause a denial of service
        (memory corruption) or possibly have unspecified other
        impact via unknown vectors, a different vulnerability
        than CVE-2016-4607, CVE-2016-4609, CVE-2016-4610, and
        CVE-2016-4612.(CVE-2016-4608)
    
      - libxslt in Apple iOS before 9.3.3, OS X before 10.11.6,
        iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on
        Windows, tvOS before 9.2.2, and watchOS before 2.2.2
        allows remote attackers to cause a denial of service
        (memory corruption) or possibly have unspecified other
        impact via unknown vectors, a different vulnerability
        than CVE-2016-4607, CVE-2016-4608, CVE-2016-4610, and
        CVE-2016-4612.(CVE-2016-4609)
    
      - libxslt in Apple iOS before 9.3.3, OS X before 10.11.6,
        iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on
        Windows, tvOS before 9.2.2, and watchOS before 2.2.2
        allows remote attackers to cause a denial of service
        (memory corruption) or possibly have unspecified other
        impact via unknown vectors, a different vulnerability
        than CVE-2016-4607, CVE-2016-4608, CVE-2016-4609, and
        CVE-2016-4612.(CVE-2016-4610)
    
      - In xsltCopyText in transform.c in libxslt 1.1.33, a
        pointer variable isn't reset under certain
        circumstances. If the relevant memory area happened to
        be freed and reused in a certain way, a bounds check
        could fail and memory outside a buffer could be written
        to, or uninitialized data could be
        disclosed.(CVE-2019-18197)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-2627
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0feeac8d");
      script_set_attribute(attribute:"solution", value:
    "Update the affected libxslt packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2019/12/18");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/18");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libxslt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libxslt-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libxslt-python");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
      script_exclude_keys("Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
    
    sp = get_kb_item("Host/EulerOS/sp");
    if (isnull(sp) || sp !~ "^(3)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP3");
    
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP3", "EulerOS UVP " + uvp);
    
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);
    
    flag = 0;
    
    pkgs = ["libxslt-1.1.28-5.h6",
            "libxslt-devel-1.1.28-5.h6",
            "libxslt-python-1.1.28-5.h6"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", sp:"3", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxslt");
    }
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2290.NASL
    descriptionAccording to the version of the libxslt packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn
    last seen2020-05-03
    modified2019-11-27
    plugin id131356
    published2019-11-27
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131356
    titleEulerOS 2.0 SP8 : libxslt (EulerOS-SA-2019-2290)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(131356);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/01");
    
      script_cve_id(
        "CVE-2019-18197"
      );
    
      script_name(english:"EulerOS 2.0 SP8 : libxslt (EulerOS-SA-2019-2290)");
      script_summary(english:"Checks the rpm output for the updated package.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS host is missing a security update.");
      script_set_attribute(attribute:"description", value:
    "According to the version of the libxslt packages installed, the
    EulerOS installation on the remote host is affected by the following
    vulnerability :
    
      - In xsltCopyText in transform.c in libxslt 1.1.33, a
        pointer variable isn't reset under certain
        circumstances. If the relevant memory area happened to
        be freed and reused in a certain way, a bounds check
        could fail and memory outside a buffer could be written
        to, or uninitialized data could be
        disclosed.(CVE-2019-18197)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-2290
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?98daf89c");
      script_set_attribute(attribute:"solution", value:
    "Update the affected libxslt package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2019/11/27");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/11/27");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libxslt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libxslt-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
      script_exclude_keys("Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
    
    sp = get_kb_item("Host/EulerOS/sp");
    if (isnull(sp) || sp !~ "^(8)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP8");
    
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP8", "EulerOS UVP " + uvp);
    
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);
    
    flag = 0;
    
    pkgs = ["libxslt-1.1.32-3.h5.eulerosv2r8",
            "libxslt-devel-1.1.32-3.h5.eulerosv2r8"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", sp:"8", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxslt");
    }
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1442.NASL
    descriptionAccording to the versions of the libxslt packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.(CVE-2019-13118) - In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.(CVE-2019-13117) - numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles the i format token for xsl:number data, which allows remote attackers to cause a denial of service (integer overflow or resource consumption) or possibly have unspecified other impact via a crafted document.(CVE-2016-1684) - numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles namespace nodes, which allows remote attackers to cause a denial of service (out-of-bounds heap memory access) or possibly have unspecified other impact via a crafted document.(CVE-2016-1683) - The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not check if the parent node is an element, which allows attackers to cause a denial of service via a crafted XML file, related to a
    last seen2020-04-30
    modified2020-04-15
    plugin id135571
    published2020-04-15
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135571
    titleEulerOS Virtualization 3.0.2.2 : libxslt (EulerOS-SA-2020-1442)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(135571);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/24");
    
      script_cve_id(
        "CVE-2015-7995",
        "CVE-2016-1683",
        "CVE-2016-1684",
        "CVE-2019-13117",
        "CVE-2019-13118",
        "CVE-2019-18197",
        "CVE-2019-5815"
      );
    
      script_name(english:"EulerOS Virtualization 3.0.2.2 : libxslt (EulerOS-SA-2020-1442)");
      script_summary(english:"Checks the rpm output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS Virtualization host is missing multiple security
    updates.");
      script_set_attribute(attribute:"description", value:
    "According to the versions of the libxslt packages installed, the
    EulerOS Virtualization installation on the remote host is affected by
    the following vulnerabilities :
    
      - In numbers.c in libxslt 1.1.33, a type holding grouping
        characters of an xsl:number instruction was too narrow
        and an invalid character/length combination could be
        passed to xsltNumberFormatDecimal, leading to a read of
        uninitialized stack data.(CVE-2019-13118)
    
      - In numbers.c in libxslt 1.1.33, an xsl:number with
        certain format strings could lead to a uninitialized
        read in xsltNumberFormatInsertNumbers. This could allow
        an attacker to discern whether a byte on the stack
        contains the characters A, a, I, i, or 0, or any other
        character.(CVE-2019-13117)
    
      - numbers.c in libxslt before 1.1.29, as used in Google
        Chrome before 51.0.2704.63, mishandles the i format
        token for xsl:number data, which allows remote
        attackers to cause a denial of service (integer
        overflow or resource consumption) or possibly have
        unspecified other impact via a crafted
        document.(CVE-2016-1684)
    
      - numbers.c in libxslt before 1.1.29, as used in Google
        Chrome before 51.0.2704.63, mishandles namespace nodes,
        which allows remote attackers to cause a denial of
        service (out-of-bounds heap memory access) or possibly
        have unspecified other impact via a crafted
        document.(CVE-2016-1683)
    
      - The xsltStylePreCompute function in preproc.c in
        libxslt 1.1.28 does not check if the parent node is an
        element, which allows attackers to cause a denial of
        service via a crafted XML file, related to a 'type
        confusion' issue.(CVE-2015-7995)
    
      - In xsltCopyText in transform.c in libxslt 1.1.33, a
        pointer variable isn't reset under certain
        circumstances. If the relevant memory area happened to
        be freed and reused in a certain way, a bounds check
        could fail and memory outside a buffer could be written
        to, or uninitialized data could be
        disclosed.(CVE-2019-18197)
    
      - Type confusion in xsltNumberFormatGetMultipleLevel
        prior to libxslt 1.1.33 could allow attackers to
        potentially exploit heap corruption via crafted XML
        data.(CVE-2019-5815)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1442
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b667262f");
      script_set_attribute(attribute:"solution", value:
    "Update the affected libxslt packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2020/04/16");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/04/15");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libxslt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libxslt-python");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:3.0.2.2");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (uvp != "3.0.2.2") audit(AUDIT_OS_NOT, "EulerOS Virtualization 3.0.2.2");
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);
    
    flag = 0;
    
    pkgs = ["libxslt-1.1.28-5.h7.eulerosv2r7",
            "libxslt-python-1.1.28-5.h7.eulerosv2r7"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxslt");
    }
    
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2019-1_0-0257_LIBXSLT.NASL
    descriptionAn update of the libxslt package has been released.
    last seen2020-06-01
    modified2020-06-02
    plugin id132524
    published2019-12-31
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132524
    titlePhoton OS 1.0: Libxslt PHSA-2019-1.0-0257
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    # The descriptive text and package checks in this plugin were
    # extracted from VMware Security Advisory PHSA-2019-1.0-0257. The text
    # itself is copyright (C) VMware, Inc.
    
    include('compat.inc');
    
    if (description)
    {
      script_id(132524);
      script_version("1.2");
      script_cvs_date("Date: 2020/01/02");
    
      script_cve_id("CVE-2019-18197");
    
      script_name(english:"Photon OS 1.0: Libxslt PHSA-2019-1.0-0257");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote PhotonOS host is missing multiple security updates.");
      script_set_attribute(attribute:"description", value:
    "An update of the libxslt package has been released.");
      script_set_attribute(attribute:"see_also", value:"https://github.com/vmware/photon/wiki/Security-Updates-1.0-257.md");
      script_set_attribute(attribute:"solution", value:
    "Update the affected Linux packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-18197");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/10/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/11/20");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/31");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:vmware:photonos:libxslt");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:photonos:1.0");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"PhotonOS Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/PhotonOS/release", "Host/PhotonOS/rpm-list");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/PhotonOS/release");
    if (isnull(release) || release !~ "^VMware Photon") audit(AUDIT_OS_NOT, "PhotonOS");
    if (release !~ "^VMware Photon (?:Linux|OS) 1\.0(\D|$)") audit(AUDIT_OS_NOT, "PhotonOS 1.0");
    
    if (!get_kb_item("Host/PhotonOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "PhotonOS", cpu);
    
    flag = 0;
    
    if (rpm_check(release:"PhotonOS-1.0", cpu:"x86_64", reference:"libxslt-1.1.29-7.ph1")) flag++;
    if (rpm_check(release:"PhotonOS-1.0", cpu:"x86_64", reference:"libxslt-debuginfo-1.1.29-7.ph1")) flag++;
    if (rpm_check(release:"PhotonOS-1.0", cpu:"x86_64", reference:"libxslt-devel-1.1.29-7.ph1")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxslt");
    }
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2541.NASL
    descriptionAccording to the version of the libxslt packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - This C library allows to transform XML files into other XML files (or HTML, text, ...) using the standard XSLT stylesheet transformation mechanism. To use it you need to have a version of libxml2 >= 2.6.27 installed. The xsltproc command is a command line interface to the XSLT engine.Security Fix(es):In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn
    last seen2020-05-08
    modified2019-12-09
    plugin id131815
    published2019-12-09
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131815
    titleEulerOS 2.0 SP5 : libxslt (EulerOS-SA-2019-2541)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(131815);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/07");
    
      script_cve_id(
        "CVE-2019-18197"
      );
    
      script_name(english:"EulerOS 2.0 SP5 : libxslt (EulerOS-SA-2019-2541)");
      script_summary(english:"Checks the rpm output for the updated package.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS host is missing a security update.");
      script_set_attribute(attribute:"description", value:
    "According to the version of the libxslt packages installed, the
    EulerOS installation on the remote host is affected by the following
    vulnerability :
    
      - This C library allows to transform XML files into other
        XML files (or HTML, text, ...) using the standard XSLT
        stylesheet transformation mechanism. To use it you need
        to have a version of libxml2 >= 2.6.27 installed. The
        xsltproc command is a command line interface to the
        XSLT engine.Security Fix(es):In xsltCopyText in
        transform.c in libxslt 1.1.33, a pointer variable isn't
        reset under certain circumstances. If the relevant
        memory area happened to be freed and reused in a
        certain way, a bounds check could fail and memory
        outside a buffer could be written to, or uninitialized
        data could be disclosed.(CVE-2019-18197)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-2541
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2ece883a");
      script_set_attribute(attribute:"solution", value:
    "Update the affected libxslt package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2019/12/09");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/09");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libxslt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libxslt-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libxslt-python");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
      script_exclude_keys("Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
    
    sp = get_kb_item("Host/EulerOS/sp");
    if (isnull(sp) || sp !~ "^(5)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP5");
    
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP5", "EulerOS UVP " + uvp);
    
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);
    
    flag = 0;
    
    pkgs = ["libxslt-1.1.28-5.h6.eulerosv2r7",
            "libxslt-devel-1.1.28-5.h6.eulerosv2r7",
            "libxslt-python-1.1.28-5.h6.eulerosv2r7"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", sp:"5", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxslt");
    }
    
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2019-2_0-0189_LIBXSLT.NASL
    descriptionAn update of the libxslt package has been released.
    last seen2020-06-01
    modified2020-06-02
    plugin id132538
    published2019-12-31
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132538
    titlePhoton OS 2.0: Libxslt PHSA-2019-2.0-0189
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    # The descriptive text and package checks in this plugin were
    # extracted from VMware Security Advisory PHSA-2019-2.0-0189. The text
    # itself is copyright (C) VMware, Inc.
    
    include('compat.inc');
    
    if (description)
    {
      script_id(132538);
      script_version("1.2");
      script_cvs_date("Date: 2020/01/02");
    
      script_cve_id("CVE-2019-18197");
    
      script_name(english:"Photon OS 2.0: Libxslt PHSA-2019-2.0-0189");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote PhotonOS host is missing multiple security updates.");
      script_set_attribute(attribute:"description", value:
    "An update of the libxslt package has been released.");
      script_set_attribute(attribute:"see_also", value:"https://github.com/vmware/photon/wiki/Security-Updates-2-189.md");
      script_set_attribute(attribute:"solution", value:
    "Update the affected Linux packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-18197");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/10/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/11/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/31");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:vmware:photonos:libxslt");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:photonos:2.0");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"PhotonOS Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/PhotonOS/release", "Host/PhotonOS/rpm-list");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/PhotonOS/release");
    if (isnull(release) || release !~ "^VMware Photon") audit(AUDIT_OS_NOT, "PhotonOS");
    if (release !~ "^VMware Photon (?:Linux|OS) 2\.0(\D|$)") audit(AUDIT_OS_NOT, "PhotonOS 2.0");
    
    if (!get_kb_item("Host/PhotonOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "PhotonOS", cpu);
    
    flag = 0;
    
    if (rpm_check(release:"PhotonOS-2.0", cpu:"x86_64", reference:"libxslt-1.1.29-7.ph2")) flag++;
    if (rpm_check(release:"PhotonOS-2.0", cpu:"x86_64", reference:"libxslt-debuginfo-1.1.29-7.ph2")) flag++;
    if (rpm_check(release:"PhotonOS-2.0", cpu:"x86_64", reference:"libxslt-devel-1.1.29-7.ph2")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxslt");
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1973.NASL
    descriptionA security vulnerability was discovered in libxslt, a XSLT 1.0 processing library written in C. In xsltCopyText in transform.c, a pointer variable is not reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed. For Debian 8
    last seen2020-06-01
    modified2020-06-02
    plugin id130286
    published2019-10-28
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130286
    titleDebian DLA-1973-1 : libxslt security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Debian Security Advisory DLA-1973-1. The text
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(130286);
      script_version("1.3");
      script_cvs_date("Date: 2019/12/18");
    
      script_cve_id("CVE-2019-18197");
    
      script_name(english:"Debian DLA-1973-1 : libxslt security update");
      script_summary(english:"Checks dpkg output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "A security vulnerability was discovered in libxslt, a XSLT 1.0
    processing library written in C.
    
    In xsltCopyText in transform.c, a pointer variable is not reset under
    certain circumstances. If the relevant memory area happened to be
    freed and reused in a certain way, a bounds check could fail and
    memory outside a buffer could be written to, or uninitialized data
    could be disclosed.
    
    For Debian 8 'Jessie', this problem has been fixed in version
    1.1.28-2+deb8u6.
    
    We recommend that you upgrade your libxslt packages.
    
    NOTE: Tenable Network Security has extracted the preceding description
    block directly from the DLA security advisory. Tenable has attempted
    to automatically clean and format it as much as possible without
    introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.debian.org/debian-lts-announce/2019/10/msg00037.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/jessie/libxslt"
      );
      script_set_attribute(attribute:"solution", value:"Upgrade the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libxslt1-dbg");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libxslt1-dev");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libxslt1.1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:python-libxslt1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:python-libxslt1-dbg");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xsltproc");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/10/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/10/27");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/10/28");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"8.0", prefix:"libxslt1-dbg", reference:"1.1.28-2+deb8u6")) flag++;
    if (deb_check(release:"8.0", prefix:"libxslt1-dev", reference:"1.1.28-2+deb8u6")) flag++;
    if (deb_check(release:"8.0", prefix:"libxslt1.1", reference:"1.1.28-2+deb8u6")) flag++;
    if (deb_check(release:"8.0", prefix:"python-libxslt1", reference:"1.1.28-2+deb8u6")) flag++;
    if (deb_check(release:"8.0", prefix:"python-libxslt1-dbg", reference:"1.1.28-2+deb8u6")) flag++;
    if (deb_check(release:"8.0", prefix:"xsltproc", reference:"1.1.28-2+deb8u6")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyWindows
    NASL idGOOGLE_CHROME_80_0_3987_87.NASL
    descriptionThe version of Google Chrome installed on the remote Windows host is prior to 80.0.3987.87. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_02_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-04-30
    modified2020-02-04
    plugin id133465
    published2020-02-04
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133465
    titleGoogle Chrome < 80.0.3987.87 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include('compat.inc');
    
    if (description)
    {
      script_id(133465);
      script_version("1.6");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/24");
    
      script_cve_id(
        "CVE-2019-18197",
        "CVE-2019-19923",
        "CVE-2019-19926",
        "CVE-2020-6381",
        "CVE-2020-6382",
        "CVE-2020-6385",
        "CVE-2020-6387",
        "CVE-2020-6388",
        "CVE-2020-6389",
        "CVE-2020-6390",
        "CVE-2020-6391",
        "CVE-2020-6392",
        "CVE-2020-6393",
        "CVE-2020-6394",
        "CVE-2020-6395",
        "CVE-2020-6396",
        "CVE-2020-6397",
        "CVE-2020-6398",
        "CVE-2020-6399",
        "CVE-2020-6400",
        "CVE-2020-6401",
        "CVE-2020-6402",
        "CVE-2020-6403",
        "CVE-2020-6404",
        "CVE-2020-6405",
        "CVE-2020-6406",
        "CVE-2020-6408",
        "CVE-2020-6409",
        "CVE-2020-6410",
        "CVE-2020-6411",
        "CVE-2020-6412",
        "CVE-2020-6413",
        "CVE-2020-6414",
        "CVE-2020-6415",
        "CVE-2020-6416",
        "CVE-2020-6417"
      );
    
      script_name(english:"Google Chrome < 80.0.3987.87 Multiple Vulnerabilities");
    
      script_set_attribute(attribute:"synopsis", value:
    "A web browser installed on the remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Google Chrome installed on the remote Windows host is prior to 80.0.3987.87. It is, therefore, affected
    by multiple vulnerabilities as referenced in the 2020_02_stable-channel-update-for-desktop advisory. Note that Nessus
    has not tested for this issue but has instead relied only on the application's self-reported version number.");
      # https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fc6a32b5");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1034394");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1031909");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1020745");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042700");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1035399");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042535");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042879");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042933");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1045874");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1017871");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1030411");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1035058");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1014371");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1022855");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1035271");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1027408");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1032090");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1039869");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1038036");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1017707");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1029375");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1006012");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1024256");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042145");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042254");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042578");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1026546");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1037889");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/881675");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/929711");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/968505");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1005713");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1021855");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1029576");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1031895");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1033824");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1048330");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Google Chrome version 80.0.3987.87 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-6406");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/10/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/02/04");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/04");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:google:chrome");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("google_chrome_installed.nasl");
      script_require_keys("SMB/Google_Chrome/Installed");
    
      exit(0);
    }
    include('google_chrome_version.inc');
    
    get_kb_item_or_exit('SMB/Google_Chrome/Installed');
    installs = get_kb_list('SMB/Google_Chrome/*');
    
    google_chrome_check_version(installs:installs, fix:'80.0.3987.87', severity:SECURITY_HOLE, xss:FALSE, xsrf:FALSE);
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1050.NASL
    descriptionAccording to the versions of the libxslt packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn
    last seen2020-06-01
    modified2020-06-02
    plugin id132804
    published2020-01-13
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132804
    titleEulerOS Virtualization for ARM 64 3.0.5.0 : libxslt (EulerOS-SA-2020-1050)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(132804);
      script_version("1.2");
      script_cvs_date("Date: 2020/01/15");
    
      script_cve_id(
        "CVE-2019-13118",
        "CVE-2019-18197"
      );
    
      script_name(english:"EulerOS Virtualization for ARM 64 3.0.5.0 : libxslt (EulerOS-SA-2020-1050)");
      script_summary(english:"Checks the rpm output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS Virtualization for ARM 64 host is missing multiple security
    updates.");
      script_set_attribute(attribute:"description", value:
    "According to the versions of the libxslt packages installed, the
    EulerOS Virtualization for ARM 64 installation on the remote host is
    affected by the following vulnerabilities :
    
      - In xsltCopyText in transform.c in libxslt 1.1.33, a
        pointer variable isn't reset under certain
        circumstances. If the relevant memory area happened to
        be freed and reused in a certain way, a bounds check
        could fail and memory outside a buffer could be written
        to, or uninitialized data could be
        disclosed.(CVE-2019-18197)
    
      - In numbers.c in libxslt 1.1.33, a type holding grouping
        characters of an xsl:number instruction was too narrow
        and an invalid character/length combination could be
        passed to xsltNumberFormatDecimal, leading to a read of
        uninitialized stack data.(CVE-2019-13118)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1050
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ba75bf19");
      script_set_attribute(attribute:"solution", value:
    "Update the affected libxslt packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2020/01/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/01/13");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libxslt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libxslt-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python2-libxslt");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:3.0.5.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (uvp != "3.0.5.0") audit(AUDIT_OS_NOT, "EulerOS Virtualization 3.0.5.0");
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);
    
    flag = 0;
    
    pkgs = ["libxslt-1.1.32-3.h6.eulerosv2r8",
            "libxslt-devel-1.1.32-3.h6.eulerosv2r8",
            "python2-libxslt-1.1.32-3.h6.eulerosv2r8"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxslt");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2020-731.NASL
    descriptionThis update for libxslt fixes the following issues : Security issues fixed : - CVE-2019-13118: Fixed a read of uninitialized stack data (bsc#1140101). - CVE-2019-13117: Fixed a uninitialized read which allowed to discern whether a byte on the stack contains certain special characters (bsc#1140095). - CVE-2019-18197: Fixed a dangling pointer in xsltCopyText which may have led to information disclosure (bsc#1154609). This update was imported from the SUSE:SLE-15:Update update project.
    last seen2020-06-06
    modified2020-05-29
    plugin id136963
    published2020-05-29
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136963
    titleopenSUSE Security Update : libxslt (openSUSE-2020-731)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2020-731.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(136963);
      script_version("1.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/05");
    
      script_cve_id("CVE-2019-13117", "CVE-2019-13118", "CVE-2019-18197");
    
      script_name(english:"openSUSE Security Update : libxslt (openSUSE-2020-731)");
      script_summary(english:"Check for the openSUSE-2020-731 patch");
    
      script_set_attribute(
        attribute:"synopsis",
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "This update for libxslt fixes the following issues :
    
    Security issues fixed :
    
      - CVE-2019-13118: Fixed a read of uninitialized stack data
        (bsc#1140101).
    
      - CVE-2019-13117: Fixed a uninitialized read which allowed
        to discern whether a byte on the stack contains certain
        special characters (bsc#1140095).
    
      - CVE-2019-18197: Fixed a dangling pointer in xsltCopyText
        which may have led to information disclosure
        (bsc#1154609).
    
    This update was imported from the SUSE:SLE-15:Update update project."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1140095"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1140101"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1154609"
      );
      script_set_attribute(
        attribute:"solution",
        value:"Update the affected libxslt packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-18197");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxslt-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxslt-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxslt-devel-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxslt-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxslt-python-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxslt-python-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxslt-tools");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxslt-tools-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxslt1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxslt1-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxslt1-32bit-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libxslt1-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:15.1");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/07/01");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/05/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/05/29");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE15\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "15.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE15.1", reference:"libxslt-debugsource-1.1.32-lp151.3.6.1") ) flag++;
    if ( rpm_check(release:"SUSE15.1", reference:"libxslt-devel-1.1.32-lp151.3.6.1") ) flag++;
    if ( rpm_check(release:"SUSE15.1", reference:"libxslt-tools-1.1.32-lp151.3.6.1") ) flag++;
    if ( rpm_check(release:"SUSE15.1", reference:"libxslt-tools-debuginfo-1.1.32-lp151.3.6.1") ) flag++;
    if ( rpm_check(release:"SUSE15.1", reference:"libxslt1-1.1.32-lp151.3.6.1") ) flag++;
    if ( rpm_check(release:"SUSE15.1", reference:"libxslt1-debuginfo-1.1.32-lp151.3.6.1") ) flag++;
    if ( rpm_check(release:"SUSE15.1", cpu:"x86_64", reference:"libxslt-devel-32bit-1.1.32-lp151.3.6.1") ) flag++;
    if ( rpm_check(release:"SUSE15.1", cpu:"x86_64", reference:"libxslt-python-1.1.32-lp151.3.6.1") ) flag++;
    if ( rpm_check(release:"SUSE15.1", cpu:"x86_64", reference:"libxslt-python-debuginfo-1.1.32-lp151.3.6.1") ) flag++;
    if ( rpm_check(release:"SUSE15.1", cpu:"x86_64", reference:"libxslt-python-debugsource-1.1.32-lp151.3.6.1") ) flag++;
    if ( rpm_check(release:"SUSE15.1", cpu:"x86_64", reference:"libxslt1-32bit-1.1.32-lp151.3.6.1") ) flag++;
    if ( rpm_check(release:"SUSE15.1", cpu:"x86_64", reference:"libxslt1-32bit-debuginfo-1.1.32-lp151.3.6.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxslt-python / libxslt-python-debuginfo / etc");
    }
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2519.NASL
    descriptionAccording to the versions of the libxslt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - This C library allows to transform XML files into other XML files (or HTML, text, ...) using the standard XSLT stylesheet transformation mechanism. To use it you need to have a version of libxml2 i1/4z= 2.6.27 installed. The xsltproc command is a command line interface to the XSLT engine.Security Fix(es):In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn
    last seen2020-05-08
    modified2019-12-04
    plugin id131672
    published2019-12-04
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131672
    titleEulerOS 2.0 SP2 : libxslt (EulerOS-SA-2019-2519)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(131672);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/07");
    
      script_cve_id(
        "CVE-2015-7995",
        "CVE-2016-1683",
        "CVE-2016-1684",
        "CVE-2016-4607",
        "CVE-2016-4608",
        "CVE-2016-4609",
        "CVE-2016-4610",
        "CVE-2016-4612",
        "CVE-2019-13117",
        "CVE-2019-13118",
        "CVE-2019-18197"
      );
    
      script_name(english:"EulerOS 2.0 SP2 : libxslt (EulerOS-SA-2019-2519)");
      script_summary(english:"Checks the rpm output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS host is missing multiple security updates.");
      script_set_attribute(attribute:"description", value:
    "According to the versions of the libxslt packages installed, the
    EulerOS installation on the remote host is affected by the following
    vulnerabilities :
    
      - This C library allows to transform XML files into other
        XML files (or HTML, text, ...) using the standard XSLT
        stylesheet transformation mechanism. To use it you need
        to have a version of libxml2 i1/4z= 2.6.27 installed. The
        xsltproc command is a command line interface to the
        XSLT engine.Security Fix(es):In xsltCopyText in
        transform.c in libxslt 1.1.33, a pointer variable isn't
        reset under certain circumstances. If the relevant
        memory area happened to be freed and reused in a
        certain way, a bounds check could fail and memory
        outside a buffer could be written to, or uninitialized
        data could be disclosed.(CVE-2019-18197)The
        xsltStylePreCompute function in preproc.c in libxslt
        1.1.28 does not check if the parent node is an element,
        which allows attackers to cause a denial of service via
        a crafted XML file, related to a 'type confusion'
        issue.(CVE-2015-7995)numbers.c in libxslt before
        1.1.29, as used in Google Chrome before 51.0.2704.63,
        mishandles namespace nodes, which allows remote
        attackers to cause a denial of service (out-of-bounds
        heap memory access) or possibly have unspecified other
        impact via a crafted document.(CVE-2016-1683)numbers.c
        in libxslt before 1.1.29, as used in Google Chrome
        before 51.0.2704.63, mishandles the i format token for
        xsl:number data, which allows remote attackers to cause
        a denial of service (integer overflow or resource
        consumption) or possibly have unspecified other impact
        via a crafted document.(CVE-2016-1684)libxslt in Apple
        iOS before 9.3.3, OS X before 10.11.6, iTunes before
        12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS
        before 9.2.2, and watchOS before 2.2.2 allows remote
        attackers to cause a denial of service (memory
        corruption) or possibly have unspecified other impact
        via unknown vectors, a different vulnerability than
        CVE-2016-4608, CVE-2016-4609, CVE-2016-4610, and
        CVE-2016-4612.(CVE-2016-4607)libxslt in Apple iOS
        before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2
        on Windows, iCloud before 5.2.1 on Windows, tvOS before
        9.2.2, and watchOS before 2.2.2 allows remote attackers
        to cause a denial of service (memory corruption) or
        possibly have unspecified other impact via unknown
        vectors, a different vulnerability than CVE-2016-4607,
        CVE-2016-4609, CVE-2016-4610, and
        CVE-2016-4612.(CVE-2016-4608)libxslt in Apple iOS
        before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2
        on Windows, iCloud before 5.2.1 on Windows, tvOS before
        9.2.2, and watchOS before 2.2.2 allows remote attackers
        to cause a denial of service (memory corruption) or
        possibly have unspecified other impact via unknown
        vectors, a different vulnerability than CVE-2016-4607,
        CVE-2016-4608, CVE-2016-4610, and
        CVE-2016-4612.(CVE-2016-4609)libxslt in Apple iOS
        before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2
        on Windows, iCloud before 5.2.1 on Windows, tvOS before
        9.2.2, and watchOS before 2.2.2 allows remote attackers
        to cause a denial of service (memory corruption) or
        possibly have unspecified other impact via unknown
        vectors, a different vulnerability than CVE-2016-4607,
        CVE-2016-4608, CVE-2016-4609, and
        CVE-2016-4612.(CVE-2016-4610)** REJECT ** DO NOT USE
        THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-1683.
        Reason: This candidate is a reservation duplicate of
        CVE-2016-1683. Notes: All CVE users should reference
        CVE-2016-1683 instead of this candidate. All references
        and descriptions in this candidate have been removed to
        prevent accidental usage.(CVE-2016-4612)In numbers.c in
        libxslt 1.1.33, an xsl:number with certain format
        strings could lead to a uninitialized read in
        xsltNumberFormatInsertNumbers. This could allow an
        attacker to discern whether a byte on the stack
        contains the characters A, a, I, i, or 0, or any other
        character.(CVE-2019-13117)In numbers.c in libxslt
        1.1.33, a type holding grouping characters of an
        xsl:number instruction was too narrow and an invalid
        character/length combination could be passed to
        xsltNumberFormatDecimal, leading to a read of
        uninitialized stack data.(CVE-2019-13118)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-2519
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7f8d3fde");
      script_set_attribute(attribute:"solution", value:
    "Update the affected libxslt packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2019/12/04");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/04");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libxslt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libxslt-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libxslt-python");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
      script_exclude_keys("Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
    
    sp = get_kb_item("Host/EulerOS/sp");
    if (isnull(sp) || sp !~ "^(2)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP2");
    
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP2", "EulerOS UVP " + uvp);
    
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);
    
    flag = 0;
    
    pkgs = ["libxslt-1.1.28-5.h6",
            "libxslt-devel-1.1.28-5.h6",
            "libxslt-python-1.1.28-5.h6"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", sp:"2", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxslt");
    }
    
  • NASL familyMisc.
    NASL idORACLE_JAVA_CPU_APR_2020_UNIX.NASL
    descriptionThe version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 7 Update 261, 8 Update 251, 11 Update 7, or 14 Update 1. It is, therefore, affected by multiple vulnerabilities related to the following components : - Oracle Java SE and Java SE Embedded are prone to a buffer overflow attack, over
    last seen2020-05-23
    modified2020-04-16
    plugin id135591
    published2020-04-16
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135591
    titleOracle Java SE 1.7.0_261 / 1.8.0_251 / 1.11.0_7 / 1.14.0_1 Multiple Vulnerabilities (Apr 2020 CPU) (Unix)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include('compat.inc');
    
    if (description)
    {
      script_id(135591);
      script_version("1.5");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/07/17");
    
      script_cve_id(
        "CVE-2019-18197",
        "CVE-2020-2754",
        "CVE-2020-2755",
        "CVE-2020-2756",
        "CVE-2020-2757",
        "CVE-2020-2764",
        "CVE-2020-2767",
        "CVE-2020-2773",
        "CVE-2020-2778",
        "CVE-2020-2781",
        "CVE-2020-2800",
        "CVE-2020-2803",
        "CVE-2020-2805",
        "CVE-2020-2816",
        "CVE-2020-2830"
      );
      script_xref(name:"IAVA", value:"2020-A-0134-S");
    
      script_name(english:"Oracle Java SE 1.7.0_261 / 1.8.0_251 / 1.11.0_7 / 1.14.0_1 Multiple Vulnerabilities (Apr 2020 CPU) (Unix)");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote host is affected by multiple vulnerabilities");
      script_set_attribute(attribute:"description", value:
    "The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 7 Update
    261, 8 Update 251, 11 Update 7, or 14 Update 1. It is, therefore, affected by multiple vulnerabilities related to the
    following components :
    
      - Oracle Java SE and Java SE Embedded are prone to a buffer overflow attack, over 'Multiple' protocol.
        This issue affects the 'JavaFX (libxslt)' component. Successful attacks of this vulnerability allow 
        unauthenticated attacker with network access to takeover of Java SE. (CVE-2019-18197)
    
      - Oracle Java SE and Java SE Embedded are prone to partial denial of service (partial DOS) vulnerability.
        An unauthenticated remote attacker can exploit this over 'Multiple' protocol. This issue affects the
        'Scripting' component. (CVE-2020-2754, CVE-2020-2755)
    
      - Oracle Java SE and Java SE Embedded are prone to partial denial of service (partial DOS) vulnerability.
        An unauthenticated remote attacker can exploit this over 'Multiple' protocol. This issue affects the
        'Serialization' component. (CVE-2020-2756, CVE-2020-2757)
    
      - Oracle Java SE prone to unauthorized read access vulnerability. An unauthenticated remote attacker can
        exploit this over 'Multiple' protocol can result in unauthorized read access to a subset of Java SE
        accessible data. This issue affects the 'Advanced Management Console' component. (CVE-2020-2764)
    
      - Oracle Java SE and Java SE Embedded are prone to unauthorized write/read access vulnerability. An
        unauthenticated remote attacker over 'HTTPS' can read, update, insert or delete access to some of Java SE
        accessible data. This issue affects the 'JSSE' component. (CVE-2020-2767)
    
      - Oracle Java SE and Java SE Embedded are prone to partial denial of service (partial DOS) vulnerability.
        An unauthenticated remote attacker can exploit this over 'Multiple' protocol. This issue affects the
        'Scripting' component. (CVE-2020-2773)
    
     It is also affected by other vulnerabilities; please see vendor advisories for more information.
    
    Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
    number.");
      script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/a/tech/docs/cpuapr2020cvrf.xml");
      script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/security-alerts/cpuapr2020.html");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Oracle JDK / JRE 14 Update 1 , 11 Update 7 , 8 Update 251 , 7 Update 261 or later.
    If necessary, remove any affected versions.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-2800");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"agent", value:"unix");
      script_set_attribute(attribute:"vuln_publication_date", value:"2020/04/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/04/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/04/16");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:jre");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:jdk");
      script_set_attribute(attribute:"stig_severity", value:"I");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Misc.");
    
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("sun_java_jre_installed_unix.nasl");
      script_require_keys("Host/Java/JRE/Installed");
    
      exit(0);
    }
    
    include('audit.inc');
    include('global_settings.inc');
    include('misc_func.inc');
    
    # Check each installed JRE.
    installs = get_kb_list_or_exit('Host/Java/JRE/Unmanaged/*');
    
    info = '';
    vuln = 0;
    vuln2 = 0;
    installed_versions = '';
    granular = '';
    
    foreach install (list_uniq(keys(installs)))
    {
      ver = install - 'Host/Java/JRE/Unmanaged/';
      if (ver !~ "^[0-9.]+") continue;
    
      installed_versions = installed_versions + ' & ' + ver;
    
    # Fixes : (JDK|JRE) 13 Update 2 / 11 Update 6 / 8 Update 241 / 7 Update 251 
      if (
        ver_compare(minver:'1.7.0', ver:ver, fix:'1.7.0_261', regexes:{0:"_(\d+)"}, strict:FALSE) < 0 ||
        ver_compare(minver:'1.8.0', ver:ver, fix:'1.8.0_251', regexes:{0:"_(\d+)"}, strict:FALSE) < 0 ||
        ver_compare(minver:'1.11.0', ver:ver, fix:'1.11.0_7', regexes:{0:"_(\d+)"}, strict:FALSE) < 0 ||
        ver_compare(minver:'1.13.0', ver:ver, fix:'1.14.0_1', regexes:{0:"_(\d+)"}, strict:FALSE) < 0
      )
      {
        dirs = make_list(get_kb_list(install));
        vuln += max_index(dirs);
    
        foreach dir (dirs)
          info += '\n  Path              : ' + dir;
    
        info += '\n  Installed version : ' + ver;
        info += '\n  Fixed version     : 1.7.0_261 / 1.8.0_251 / 1.11.0_7 / 1.14.0_1\n';
      }
      else if (ver =~ "^[\d\.]+$")
      {
        dirs = make_list(get_kb_list(install));
        foreach dir (dirs)
          granular += 'The Oracle Java version '+ver+' at '+dir+' is not granular enough to make a determination.'+'\n';
      }
      else
      {
        dirs = make_list(get_kb_list(install));
        vuln2 += max_index(dirs);
      }
    
    }
    
    # Report if any were found to be vulnerable.
    if (info)
    {
      if (vuln > 1) s = 's of Java are';
      else s = ' of Java is';
    
      report =
        '\n' +
        'The following vulnerable instance'+s+' installed on the\n' +
        'remote host :\n' +
        info;
      security_report_v4(severity:SECURITY_WARNING, port:0, extra:report);
      if (granular) exit(0, granular);
    }
    else
    {
      if (granular) exit(0, granular);
    
      installed_versions = substr(installed_versions, 3);
      if (vuln2 > 1)
        exit(0, 'The Java '+installed_versions+' installations on the remote host are not affected.');
      else
        audit(AUDIT_INST_VER_NOT_VULN, 'Java', installed_versions);
    }
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-4164-1.NASL
    descriptionIt was discovered that Libxslt incorrectly handled certain documents. An attacker could possibly use this issue to access sensitive information. This issue not affected Ubuntu 19.10. (CVE-2019-13117, CVE-2019-13118) It was discovered that Libxslt incorrectly handled certain documents. An attacker could possibly use this issue to execute arbitrary code. (CVE-2019-18197). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id130167
    published2019-10-23
    reporterUbuntu Security Notice (C) 2019 Canonical, Inc. / NASL script (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130167
    titleUbuntu 16.04 LTS / 18.04 LTS / 19.04 / 19.10 : libxslt vulnerabilities (USN-4164-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-4164-1. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(130167);
      script_version("1.3");
      script_cvs_date("Date: 2019/12/18");
    
      script_cve_id("CVE-2019-13117", "CVE-2019-13118", "CVE-2019-18197");
      script_xref(name:"USN", value:"4164-1");
    
      script_name(english:"Ubuntu 16.04 LTS / 18.04 LTS / 19.04 / 19.10 : libxslt vulnerabilities (USN-4164-1)");
      script_summary(english:"Checks dpkg output for updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Ubuntu host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "It was discovered that Libxslt incorrectly handled certain documents.
    An attacker could possibly use this issue to access sensitive
    information. This issue not affected Ubuntu 19.10. (CVE-2019-13117,
    CVE-2019-13118)
    
    It was discovered that Libxslt incorrectly handled certain documents.
    An attacker could possibly use this issue to execute arbitrary code.
    (CVE-2019-18197).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/4164-1/"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected libxslt1.1 package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libxslt1.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.04:-:lts");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:19.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:19.10");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/07/01");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/10/22");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/10/23");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2019 Canonical, Inc. / NASL script (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! preg(pattern:"^(12\.04|14\.04|16\.04|18\.04|19\.04|19\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 12.04 / 14.04 / 16.04 / 18.04 / 19.04 / 19.10", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"16.04", pkgname:"libxslt1.1", pkgver:"1.1.28-2.1ubuntu0.3")) flag++;
    if (ubuntu_check(osver:"18.04", pkgname:"libxslt1.1", pkgver:"1.1.29-5ubuntu0.2")) flag++;
    if (ubuntu_check(osver:"19.04", pkgname:"libxslt1.1", pkgver:"1.1.32-2ubuntu0.2")) flag++;
    if (ubuntu_check(osver:"19.10", pkgname:"libxslt1.1", pkgver:"1.1.33-0ubuntu1.1")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxslt1.1");
    }
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_GOOGLE_CHROME_80_0_3987_87.NASL
    descriptionThe version of Google Chrome installed on the remote macOS host is prior to 80.0.3987.87. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_02_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-04-30
    modified2020-02-04
    plugin id133464
    published2020-02-04
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133464
    titleGoogle Chrome < 80.0.3987.87 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include('compat.inc');
    
    if (description)
    {
      script_id(133464);
      script_version("1.6");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/24");
    
      script_cve_id(
        "CVE-2019-18197",
        "CVE-2019-19923",
        "CVE-2019-19926",
        "CVE-2020-6381",
        "CVE-2020-6382",
        "CVE-2020-6385",
        "CVE-2020-6387",
        "CVE-2020-6388",
        "CVE-2020-6389",
        "CVE-2020-6390",
        "CVE-2020-6391",
        "CVE-2020-6392",
        "CVE-2020-6393",
        "CVE-2020-6394",
        "CVE-2020-6395",
        "CVE-2020-6396",
        "CVE-2020-6397",
        "CVE-2020-6398",
        "CVE-2020-6399",
        "CVE-2020-6400",
        "CVE-2020-6401",
        "CVE-2020-6402",
        "CVE-2020-6403",
        "CVE-2020-6404",
        "CVE-2020-6405",
        "CVE-2020-6406",
        "CVE-2020-6408",
        "CVE-2020-6409",
        "CVE-2020-6410",
        "CVE-2020-6411",
        "CVE-2020-6412",
        "CVE-2020-6413",
        "CVE-2020-6414",
        "CVE-2020-6415",
        "CVE-2020-6416",
        "CVE-2020-6417"
      );
    
      script_name(english:"Google Chrome < 80.0.3987.87 Multiple Vulnerabilities");
    
      script_set_attribute(attribute:"synopsis", value:
    "A web browser installed on the remote macOS host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Google Chrome installed on the remote macOS host is prior to 80.0.3987.87. It is, therefore, affected by
    multiple vulnerabilities as referenced in the 2020_02_stable-channel-update-for-desktop advisory. Note that Nessus has
    not tested for this issue but has instead relied only on the application's self-reported version number.");
      # https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fc6a32b5");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1034394");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1031909");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1020745");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042700");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1035399");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042535");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042879");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042933");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1045874");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1017871");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1030411");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1035058");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1014371");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1022855");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1035271");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1027408");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1032090");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1039869");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1038036");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1017707");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1029375");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1006012");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1024256");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042145");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042254");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042578");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1026546");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1037889");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/881675");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/929711");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/968505");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1005713");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1021855");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1029576");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1031895");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1033824");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1048330");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Google Chrome version 80.0.3987.87 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-6406");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/10/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/02/04");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/04");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:google:chrome");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("macosx_google_chrome_installed.nbin");
      script_require_keys("MacOSX/Google Chrome/Installed");
    
      exit(0);
    }
    include('google_chrome_version.inc');
    
    get_kb_item_or_exit('MacOSX/Google Chrome/Installed');
    
    google_chrome_check_version(fix:'80.0.3987.87', severity:SECURITY_HOLE, xss:FALSE, xsrf:FALSE);
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-0514.NASL
    descriptionAn update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Chromium is an open source web browser, powered by WebKit (Blink). This update upgrades Chromium to version 80.0.3987.87. Security Fix(es) : * chromium-browser: Integer overflow in JavaScript (CVE-2020-6381) * chromium-browser: Type Confusion in JavaScript (CVE-2020-6382) * chromium-browser: Insufficient policy enforcement in storage (CVE-2020-6385) * chromium-browser: Out of bounds write in WebRTC (CVE-2020-6387) * chromium-browser: Out of bounds memory access in WebAudio (CVE-2020-6388) * chromium-browser: Out of bounds write in WebRTC (CVE-2020-6389) * chromium-browser: Out of bounds memory access in streams (CVE-2020-6390) * libxslt: use after free in xsltCopyText in transform.c could lead to information disclosure (CVE-2019-18197) * sqlite: invalid pointer dereference in exprListAppendList in window.c (CVE-2019-19880) * sqlite: mishandling of certain uses of SELECT DISTINCT involving a LEFT JOIN in flattenSubquery in select.c leads to a NULL pointer dereference (CVE-2019-19923) * sqlite: zipfileUpdate in ext/misc/zipfile.c mishandles a NULL pathname during an update of a ZIP archive (CVE-2019-19925) * sqlite: error mishandling because of incomplete fix of CVE-2019-19880 (CVE-2019-19926) * chromium-browser: Insufficient validation of untrusted input in Blink (CVE-2020-6391) * chromium-browser: Insufficient policy enforcement in extensions (CVE-2020-6392) * chromium-browser: Insufficient policy enforcement in Blink (CVE-2020-6393) * chromium-browser: Insufficient policy enforcement in Blink (CVE-2020-6394) * chromium-browser: Out of bounds read in JavaScript (CVE-2020-6395) * chromium-browser: Inappropriate implementation in Skia (CVE-2020-6396) * chromium-browser: Incorrect security UI in sharing (CVE-2020-6397) * chromium-browser: Uninitialized use in PDFium (CVE-2020-6398) * chromium-browser: Insufficient policy enforcement in AppCache (CVE-2020-6399) * chromium-browser: Inappropriate implementation in CORS (CVE-2020-6400) * chromium-browser: Insufficient validation of untrusted input in Omnibox (CVE-2020-6401) * chromium-browser: Insufficient policy enforcement in downloads (CVE-2020-6402) * chromium-browser: Incorrect security UI in Omnibox (CVE-2020-6403) * chromium-browser: Inappropriate implementation in Blink (CVE-2020-6404) * sqlite: Out-of-bounds read in SELECT with ON/USING clause (CVE-2020-6405) * chromium-browser: Use after free in audio (CVE-2020-6406) * chromium-browser: Insufficient policy enforcement in CORS (CVE-2020-6408) * chromium-browser: Inappropriate implementation in Omnibox (CVE-2020-6409) * chromium-browser: Insufficient policy enforcement in navigation (CVE-2020-6410) * chromium-browser: Insufficient validation of untrusted input in Omnibox (CVE-2020-6411) * chromium-browser: Insufficient validation of untrusted input in Omnibox (CVE-2020-6412) * chromium-browser: Inappropriate implementation in Blink (CVE-2020-6413) * chromium-browser: Insufficient policy enforcement in Safe Browsing (CVE-2020-6414) * chromium-browser: Inappropriate implementation in JavaScript (CVE-2020-6415) * chromium-browser: Insufficient data validation in streams (CVE-2020-6416) * chromium-browser: Inappropriate implementation in installer (CVE-2020-6417) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-06-02
    modified2020-02-18
    plugin id133749
    published2020-02-18
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133749
    titleRHEL 6 : chromium-browser (RHSA-2020:0514)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2020:0514. The text
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(133749);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/01");
    
      script_cve_id("CVE-2019-18197", "CVE-2019-19880", "CVE-2019-19923", "CVE-2019-19925", "CVE-2019-19926", "CVE-2020-6381", "CVE-2020-6382", "CVE-2020-6385", "CVE-2020-6387", "CVE-2020-6388", "CVE-2020-6389", "CVE-2020-6390", "CVE-2020-6391", "CVE-2020-6392", "CVE-2020-6393", "CVE-2020-6394", "CVE-2020-6395", "CVE-2020-6396", "CVE-2020-6397", "CVE-2020-6398", "CVE-2020-6399", "CVE-2020-6400", "CVE-2020-6401", "CVE-2020-6402", "CVE-2020-6403", "CVE-2020-6404", "CVE-2020-6405", "CVE-2020-6406", "CVE-2020-6408", "CVE-2020-6409", "CVE-2020-6410", "CVE-2020-6411", "CVE-2020-6412", "CVE-2020-6413", "CVE-2020-6414", "CVE-2020-6415", "CVE-2020-6416", "CVE-2020-6417");
      script_xref(name:"RHSA", value:"2020:0514");
    
      script_name(english:"RHEL 6 : chromium-browser (RHSA-2020:0514)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis",
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "An update for chromium-browser is now available for Red Hat Enterprise
    Linux 6 Supplementary.
    
    Red Hat Product Security has rated this update as having a security
    impact of Important. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    Chromium is an open source web browser, powered by WebKit (Blink).
    
    This update upgrades Chromium to version 80.0.3987.87.
    
    Security Fix(es) :
    
    * chromium-browser: Integer overflow in JavaScript (CVE-2020-6381)
    
    * chromium-browser: Type Confusion in JavaScript (CVE-2020-6382)
    
    * chromium-browser: Insufficient policy enforcement in storage
    (CVE-2020-6385)
    
    * chromium-browser: Out of bounds write in WebRTC (CVE-2020-6387)
    
    * chromium-browser: Out of bounds memory access in WebAudio
    (CVE-2020-6388)
    
    * chromium-browser: Out of bounds write in WebRTC (CVE-2020-6389)
    
    * chromium-browser: Out of bounds memory access in streams
    (CVE-2020-6390)
    
    * libxslt: use after free in xsltCopyText in transform.c could lead to
    information disclosure (CVE-2019-18197)
    
    * sqlite: invalid pointer dereference in exprListAppendList in
    window.c (CVE-2019-19880)
    
    * sqlite: mishandling of certain uses of SELECT DISTINCT involving a
    LEFT JOIN in flattenSubquery in select.c leads to a NULL pointer
    dereference (CVE-2019-19923)
    
    * sqlite: zipfileUpdate in ext/misc/zipfile.c mishandles a NULL
    pathname during an update of a ZIP archive (CVE-2019-19925)
    
    * sqlite: error mishandling because of incomplete fix of
    CVE-2019-19880 (CVE-2019-19926)
    
    * chromium-browser: Insufficient validation of untrusted input in
    Blink (CVE-2020-6391)
    
    * chromium-browser: Insufficient policy enforcement in extensions
    (CVE-2020-6392)
    
    * chromium-browser: Insufficient policy enforcement in Blink
    (CVE-2020-6393)
    
    * chromium-browser: Insufficient policy enforcement in Blink
    (CVE-2020-6394)
    
    * chromium-browser: Out of bounds read in JavaScript (CVE-2020-6395)
    
    * chromium-browser: Inappropriate implementation in Skia
    (CVE-2020-6396)
    
    * chromium-browser: Incorrect security UI in sharing (CVE-2020-6397)
    
    * chromium-browser: Uninitialized use in PDFium (CVE-2020-6398)
    
    * chromium-browser: Insufficient policy enforcement in AppCache
    (CVE-2020-6399)
    
    * chromium-browser: Inappropriate implementation in CORS
    (CVE-2020-6400)
    
    * chromium-browser: Insufficient validation of untrusted input in
    Omnibox (CVE-2020-6401)
    
    * chromium-browser: Insufficient policy enforcement in downloads
    (CVE-2020-6402)
    
    * chromium-browser: Incorrect security UI in Omnibox (CVE-2020-6403)
    
    * chromium-browser: Inappropriate implementation in Blink
    (CVE-2020-6404)
    
    * sqlite: Out-of-bounds read in SELECT with ON/USING clause
    (CVE-2020-6405)
    
    * chromium-browser: Use after free in audio (CVE-2020-6406)
    
    * chromium-browser: Insufficient policy enforcement in CORS
    (CVE-2020-6408)
    
    * chromium-browser: Inappropriate implementation in Omnibox
    (CVE-2020-6409)
    
    * chromium-browser: Insufficient policy enforcement in navigation
    (CVE-2020-6410)
    
    * chromium-browser: Insufficient validation of untrusted input in
    Omnibox (CVE-2020-6411)
    
    * chromium-browser: Insufficient validation of untrusted input in
    Omnibox (CVE-2020-6412)
    
    * chromium-browser: Inappropriate implementation in Blink
    (CVE-2020-6413)
    
    * chromium-browser: Insufficient policy enforcement in Safe Browsing
    (CVE-2020-6414)
    
    * chromium-browser: Inappropriate implementation in JavaScript
    (CVE-2020-6415)
    
    * chromium-browser: Insufficient data validation in streams
    (CVE-2020-6416)
    
    * chromium-browser: Inappropriate implementation in installer
    (CVE-2020-6417)
    
    For more details about the security issue(s), including the impact, a
    CVSS score, acknowledgments, and other related information, refer to
    the CVE page(s) listed in the References section."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2020:0514"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2019-18197"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2019-19880"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2019-19923"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2019-19925"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2019-19926"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6381"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6382"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6385"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6387"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6388"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6389"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6390"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6391"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6392"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6393"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6394"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6395"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6396"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6397"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6398"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6399"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6400"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6401"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6402"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6403"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6404"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6405"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6406"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6408"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6409"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6410"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6411"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6412"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6413"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6414"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6415"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6416"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6417"
      );
      script_set_attribute(
        attribute:"solution",
        value:
    "Update the affected chromium-browser and / or
    chromium-browser-debuginfo packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-6406");
      script_cwe_id(125, 20, 416, 476, 476, 476);
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:redhat:enterprise_linux:6");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:redhat:rhel_extras:6");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:chromium-browser");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/10/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/02/17");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/18");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 6.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);
    
    pkgs = [
        {'reference':'chromium-browser-80.0.3987.87-1.el6_10', 'cpu':'i686', 'release':'6', 'allowmaj':TRUE},
        {'reference':'chromium-browser-80.0.3987.87-1.el6_10', 'cpu':'x86_64', 'release':'6', 'allowmaj':TRUE}
    ];
    
    flag = 0;
    foreach package_array ( pkgs ) {
      reference = NULL;
      release = NULL;
      sp = NULL;
      cpu = NULL;
      el_string = NULL;
      rpm_spec_vers_cmp = NULL;
      epoch = NULL;
      allowmaj = NULL;
      if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
      if (!empty_or_null(package_array['release'])) release = 'RHEL' + package_array['release'];
      if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
      if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
      if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
      if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
      if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
      if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
      if (reference && release) {
        if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;
      }
    }
    
    if (flag)
    {
      security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'chromium-browser');
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2020-0920-1.NASL
    descriptionThis update for libxslt fixes the following issue : CVE-2019-18197: Fixed a dangling pointer in xsltCopyText which may have led to information disclosure (bsc#1154609). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-04-10
    modified2020-04-06
    plugin id135227
    published2020-04-06
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135227
    titleSUSE SLES12 Security Update : libxslt (SUSE-SU-2020:0920-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from SUSE update advisory SUSE-SU-2020:0920-1.
    # The text itself is copyright (C) SUSE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(135227);
      script_version("1.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/08");
    
      script_cve_id("CVE-2019-18197");
    
      script_name(english:"SUSE SLES12 Security Update : libxslt (SUSE-SU-2020:0920-1)");
      script_summary(english:"Checks rpm output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SUSE host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for libxslt fixes the following issue :
    
    CVE-2019-18197: Fixed a dangling pointer in xsltCopyText which may
    have led to information disclosure (bsc#1154609).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the SUSE security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1154609"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2019-18197/"
      );
      # https://www.suse.com/support/update/announcement/2020/suse-su-20200920-1/
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?61844c0e"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "To install this SUSE Security Update use the SUSE recommended
    installation methods like YaST online_update or 'zypper patch'.
    
    Alternatively you can run the command listed for your product :
    
    SUSE Linux Enterprise Software Development Kit 12-SP5:zypper in -t
    patch SUSE-SLE-SDK-12-SP5-2020-920=1
    
    SUSE Linux Enterprise Software Development Kit 12-SP4:zypper in -t
    patch SUSE-SLE-SDK-12-SP4-2020-920=1
    
    SUSE Linux Enterprise Server 12-SP5:zypper in -t patch
    SUSE-SLE-SERVER-12-SP5-2020-920=1
    
    SUSE Linux Enterprise Server 12-SP4:zypper in -t patch
    SUSE-SLE-SERVER-12-SP4-2020-920=1
    
    SUSE CaaS Platform 3.0 :
    
    To install this update, use the SUSE CaaS Platform Velum dashboard. It
    will inform you if it detects new updates and let you then trigger
    updating of the complete cluster in a controlled way."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libxslt-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libxslt-tools");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libxslt-tools-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libxslt1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libxslt1-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/10/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/04/03");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/04/06");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
    os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLES12", "SUSE " + os_ver);
    
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
    
    sp = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(sp)) sp = "0";
    if (os_ver == "SLES12" && (! preg(pattern:"^(4|5)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP4/5", os_ver + " SP" + sp);
    
    
    flag = 0;
    if (rpm_check(release:"SLES12", sp:"4", reference:"libxslt-debugsource-1.1.28-17.9.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"libxslt-tools-1.1.28-17.9.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"libxslt-tools-debuginfo-1.1.28-17.9.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"libxslt1-1.1.28-17.9.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"libxslt1-debuginfo-1.1.28-17.9.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"libxslt1-32bit-1.1.28-17.9.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"libxslt1-debuginfo-32bit-1.1.28-17.9.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"5", reference:"libxslt-debugsource-1.1.28-17.9.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"5", reference:"libxslt-tools-1.1.28-17.9.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"5", reference:"libxslt-tools-debuginfo-1.1.28-17.9.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"5", reference:"libxslt1-1.1.28-17.9.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"5", reference:"libxslt1-debuginfo-1.1.28-17.9.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"5", reference:"libxslt1-32bit-1.1.28-17.9.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"5", reference:"libxslt1-debuginfo-32bit-1.1.28-17.9.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxslt");
    }
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2020-1215.NASL
    descriptionAccording to the versions of the libxslt packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles the i format token for xsl:number data, which allows remote attackers to cause a denial of service (integer overflow or resource consumption) or possibly have unspecified other impact via a crafted document.(CVE-2016-1684) - numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles namespace nodes, which allows remote attackers to cause a denial of service (out-of-bounds heap memory access) or possibly have unspecified other impact via a crafted document.(CVE-2016-1683) - A type confusion vulnerability was discovered in the xsltStylePreCompute() function of libxslt. A remote attacker could possibly exploit this flaw to cause an application using libxslt to crash by tricking the application into processing a specially crafted XSLT document.(CVE-2015-7995) - In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn
    last seen2020-03-19
    modified2020-03-13
    plugin id134504
    published2020-03-13
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134504
    titleEulerOS Virtualization for ARM 64 3.0.2.0 : libxslt (EulerOS-SA-2020-1215)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(134504);
      script_version("1.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/19");
    
      script_cve_id(
        "CVE-2015-7995",
        "CVE-2016-1683",
        "CVE-2016-1684",
        "CVE-2019-18197"
      );
    
      script_name(english:"EulerOS Virtualization for ARM 64 3.0.2.0 : libxslt (EulerOS-SA-2020-1215)");
      script_summary(english:"Checks the rpm output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS Virtualization for ARM 64 host is missing multiple security
    updates.");
      script_set_attribute(attribute:"description", value:
    "According to the versions of the libxslt packages installed, the
    EulerOS Virtualization for ARM 64 installation on the remote host is
    affected by the following vulnerabilities :
    
      - numbers.c in libxslt before 1.1.29, as used in Google
        Chrome before 51.0.2704.63, mishandles the i format
        token for xsl:number data, which allows remote
        attackers to cause a denial of service (integer
        overflow or resource consumption) or possibly have
        unspecified other impact via a crafted
        document.(CVE-2016-1684)
    
      - numbers.c in libxslt before 1.1.29, as used in Google
        Chrome before 51.0.2704.63, mishandles namespace nodes,
        which allows remote attackers to cause a denial of
        service (out-of-bounds heap memory access) or possibly
        have unspecified other impact via a crafted
        document.(CVE-2016-1683)
    
      - A type confusion vulnerability was discovered in the
        xsltStylePreCompute() function of libxslt. A remote
        attacker could possibly exploit this flaw to cause an
        application using libxslt to crash by tricking the
        application into processing a specially crafted XSLT
        document.(CVE-2015-7995)
    
      - In xsltCopyText in transform.c in libxslt 1.1.33, a
        pointer variable isn't reset under certain
        circumstances. If the relevant memory area happened to
        be freed and reused in a certain way, a bounds check
        could fail and memory outside a buffer could be written
        to, or uninitialized data could be
        disclosed.(CVE-2019-18197)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1215
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?67c0c3ea");
      script_set_attribute(attribute:"solution", value:
    "Update the affected libxslt packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2020/03/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/03/13");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libxslt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libxslt-python");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:3.0.2.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (uvp != "3.0.2.0") audit(AUDIT_OS_NOT, "EulerOS Virtualization 3.0.2.0");
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);
    
    flag = 0;
    
    pkgs = ["libxslt-1.1.28-5.h6",
            "libxslt-python-1.1.28-5.h6"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libxslt");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2020-189.NASL
    descriptionThis update for chromium fixes the following issues : Chromium was updated to version 80.0.3987.87 (boo#1162833). Security issues fixed : - CVE-2020-6381: Integer overflow in JavaScript (boo#1162833). - CVE-2020-6382: Type Confusion in JavaScript (boo#1162833). - CVE-2019-18197: Multiple vulnerabilities in XML (boo#1162833). - CVE-2019-19926: Inappropriate implementation in SQLite (boo#1162833). - CVE-2020-6385: Insufficient policy enforcement in storage (boo#1162833). - CVE-2019-19880, CVE-2019-19925: Multiple vulnerabilities in SQLite (boo#1162833). - CVE-2020-6387: Out of bounds write in WebRTC (boo#1162833). - CVE-2020-6388: Out of bounds memory access in WebAudio (boo#1162833). - CVE-2020-6389: Out of bounds write in WebRTC (boo#1162833). - CVE-2020-6390: Out of bounds memory access in streams (boo#1162833). - CVE-2020-6391: Insufficient validation of untrusted input in Blink (boo#1162833). - CVE-2020-6392: Insufficient policy enforcement in extensions (boo#1162833). - CVE-2020-6393: Insufficient policy enforcement in Blink (boo#1162833). - CVE-2020-6394: Insufficient policy enforcement in Blink (boo#1162833). - CVE-2020-6395: Out of bounds read in JavaScript (boo#1162833). - CVE-2020-6396: Inappropriate implementation in Skia (boo#1162833). - CVE-2020-6397: Incorrect security UI in sharing (boo#1162833). - CVE-2020-6398: Uninitialized use in PDFium (boo#1162833). - CVE-2020-6399: Insufficient policy enforcement in AppCache (boo#1162833). - CVE-2020-6400: Inappropriate implementation in CORS (boo#1162833). - CVE-2020-6401: Insufficient validation of untrusted input in Omnibox (boo#1162833). - CVE-2020-6402: Insufficient policy enforcement in downloads (boo#1162833). - CVE-2020-6403: Incorrect security UI in Omnibox (boo#1162833). - CVE-2020-6404: Inappropriate implementation in Blink (boo#1162833). - CVE-2020-6405: Out of bounds read in SQLite (boo#1162833). - CVE-2020-6406: Use after free in audio (boo#1162833). - CVE-2019-19923: Out of bounds memory access in SQLite (boo#1162833). - CVE-2020-6408: Insufficient policy enforcement in CORS (boo#1162833). - CVE-2020-6409: Inappropriate implementation in Omnibox (boo#1162833). - CVE-2020-6410: Insufficient policy enforcement in navigation (boo#1162833). - CVE-2020-6411: Insufficient validation of untrusted input in Omnibox (boo#1162833). - CVE-2020-6412: Insufficient validation of untrusted input in Omnibox (boo#1162833). - CVE-2020-6413: Inappropriate implementation in Blink (boo#1162833). - CVE-2020-6414: Insufficient policy enforcement in Safe Browsing (boo#1162833). - CVE-2020-6415: Inappropriate implementation in JavaScript (boo#1162833). - CVE-2020-6416: Insufficient data validation in streams (boo#1162833). - CVE-2020-6417: Inappropriate implementation in installer (boo#1162833).
    last seen2020-05-31
    modified2020-02-10
    plugin id133593
    published2020-02-10
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133593
    titleopenSUSE Security Update : chromium (openSUSE-2020-189)

Redhat

advisories
rhsa
idRHSA-2020:0514
rpms
  • chromium-browser-0:80.0.3987.87-1.el6_10
  • chromium-browser-debuginfo-0:80.0.3987.87-1.el6_10

References