Multiple use-after-free vulnerabilities in libxml2 2.9.0 and possibly other versions might allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to the (1) htmlParseChunk and (2) xmldecl_done functions, as demonstrated by a buffer overflow in the xmlBufGetInputBase function.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

The remote Solaris system is missing necessary patches to address security updates :

  - Multiple use-after-free vulnerabilities in libxml2 2.9.0     and possibly other versions might allow     context-dependent attackers to cause a denial of service     (crash) and possibly execute arbitrary code via vectors     related to the (1) htmlParseChunk and (2) xmldecl_done     functions, as demonstrated by a buffer overflow in the     xmlBufGetInputBase function. (CVE-2013-1969)

The remote host is affected by the vulnerability described in GLSA-201412-11 (AMD64 x86 emulation base libraries: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in AMD64 x86 emulation       base libraries. Please review the CVE identifiers referenced below for       details.
  Impact :

    A context-dependent attacker may be able to execute arbitrary code,       cause a Denial of Service condition, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

- fix for CVE-2013-1969 (bnc#815665)

  - libxml2-CVE-2013-1969.patch

The remote host is affected by the vulnerability described in GLSA-201311-06 (libxml2: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libxml2. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted       document with an application linked against libxml2, possibly resulting       in execution of arbitrary code with the privileges of the process or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

It was discovered that libxml2 incorrectly handled memory management when parsing certain XML files. An attacker could use this flaw to cause libxml2 to crash, resulting in a denial of service, or to possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	critical
80691	Oracle Solaris Third-Party Patch Update : libxml2 (cve_2013_1969_resource_management)	Nessus	Solaris Local Security Checks	high
79964	GLSA-201412-11 : AMD64 x86 emulation base libraries: Multiple vulnerabilities (Heartbleed)	Nessus	Gentoo Local Security Checks	critical
74982	openSUSE Security Update : libxml2 (openSUSE-SU-2013:0945-1)	Nessus	SuSE Local Security Checks	high
70836	GLSA-201311-06 : libxml2: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
66346	Ubuntu 13.04 : libxml2 vulnerability (USN-1817-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2013-1969

critical

Tenable Plugins

critical

high

critical

high

high

high