91528

USN-3013-1

https://bugzilla.redhat.com/show_bug.cgi?id=1344251

GLSA-201701-21

https://sourceforge.net/p/expat/code_git/ci/f0bec73b018caa07d3e75ec8dd967f3785d71bde

https://www.tenable.com/security/tns-2016-20

According to the versions of the expat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In libexpat in Expat before 2.2.7, XML input including     XML names that contain a large number of colons could     make the XML parser consume a high amount of RAM and     CPU resources while processing (enough to be usable for     denial-of-service attacks).(CVE-2018-20843)

  - ( Multiple integer overflows in the XML_GetBuffer     function in Expat through 2.1.0, as used in Google     Chrome before 44.0.2403.89 and other products, allow     remote attackers to cause a denial of service     (heap-based buffer overflow) or possibly have     unspecified other impact via crafted XML data, a     related issue to CVE-2015-2716.(CVE-2015-1283)

  - The overflow protection in Expat is removed by     compilers with certain optimization settings, which     allows remote attackers to cause a denial of service     (crash) or possibly execute arbitrary code via crafted     XML data. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2015-1283 and     CVE-2015-2716.(CVE-2016-4472)

  - The XML parser in Expat does not use sufficient entropy     for hash initialization, which allows context-dependent     attackers to cause a denial of service (CPU     consumption) via crafted identifiers in an XML     document. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2012-0876.(CVE-2016-5300)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the expat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ( Multiple integer overflows in the XML_GetBuffer     function in Expat through 2.1.0, as used in Google     Chrome before 44.0.2403.89 and other products, allow     remote attackers to cause a denial of service     (heap-based buffer overflow) or possibly have     unspecified other impact via crafted XML data, a     related issue to CVE-2015-2716.(CVE-2015-1283)

  - The overflow protection in Expat is removed by     compilers with certain optimization settings, which     allows remote attackers to cause a denial of service     (crash) or possibly execute arbitrary code via crafted     XML data. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2015-1283 and     CVE-2015-2716.(CVE-2016-4472)

  - The XML parser in Expat does not use sufficient entropy     for hash initialization, which allows context-dependent     attackers to cause a denial of service (CPU     consumption) via crafted identifiers in an XML     document. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2012-0876.(CVE-2016-5300)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the expat packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The XML parser in Expat does not use sufficient entropy     for hash initialization, which allows context-dependent     attackers to cause a denial of service (CPU     consumption) via crafted identifiers in an XML     document. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2012-0876.(CVE-2016-5300)

  - The overflow protection in Expat is removed by     compilers with certain optimization settings, which     allows remote attackers to cause a denial of service     (crash) or possibly execute arbitrary code via crafted     XML data. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2015-1283 and     CVE-2015-2716.(CVE-2016-4472)

  - Multiple integer overflows in the XML_GetBuffer     function in Expat through 2.1.0, as used in Google     Chrome before 44.0.2403.89 and other products, allow     remote attackers to cause a denial of service     (heap-based buffer overflow) or possibly have     unspecified other impact via crafted XML data, a     related issue to CVE-2015-2716.(CVE-2015-1283)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

python release notes :

Multiple vulnerabilities has been fixed in this release. Please refer to the CVE list for details.

New python packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix security issues.

Python reports :

Multiple vulnerabilities have been fixed in Python 2.7.14. Please refer to the CVE list for details.

New python packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix a security issue.

The version of Apple iTunes installed on the remote macOS or Mac OS X host is prior to 12.6. It is, therefore, affected by multiple vulnerabilities :

  - Multiple vulnerabilities exist in the expat component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2009-3270,     CVE-2009-3560, CVE-2009-3720, CVE-2012-1147,     CVE-2012-1148, CVE-2012-6702, CVE-2015-1283,     CVE-2016-0718, CVE-2016-4472, CVE-2016-5300)

  - Multiple vulnerabilities exist in the SQLite component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities by convincing a user to     open a specially crafted file, to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2013-7443,     CVE-2015-3414, CVE-2015-3415, CVE-2015-3416,     CVE-2015-3717, CVE-2015-6607, CVE-2016-6153)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iTunes running on the remote host is prior to 12.6. It is, therefore, affected by multiple vulnerabilities :

  - Multiple vulnerabilities exist in the expat component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2009-3270,     CVE-2009-3560, CVE-2009-3720, CVE-2012-1147,     CVE-2012-1148, CVE-2012-6702, CVE-2015-1283,     CVE-2016-0718, CVE-2016-4472, CVE-2016-5300)

  - Multiple vulnerabilities exist in the SQLite component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities by convincing a user to     open a specially crafted file, to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2013-7443,     CVE-2015-3414, CVE-2015-3415, CVE-2015-3416,     CVE-2015-3717, CVE-2015-6607, CVE-2016-6153)

  - An information disclosure vulnerability exists in the     APNs server component due to client certificates being     transmitted in cleartext. A man-in-the-middle attacker     can exploit this to disclose sensitive information.
    (CVE-2017-2383)

  - A use-after-free error exists in the WebKit component     due to improper handling of RenderBox objects. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-2463)

  - Multiple universal cross-site scripting (XSS)     vulnerabilities exist in the WebKit component due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these     vulnerabilities, by convincing a user to visit a     specially crafted web page, to execute arbitrary script     code in a user's browser session. (CVE-2017-2479,     CVE-2017-2480, CVE-2017-2493)

  - An integer overflow condition exists in the libxslt     component in the xsltAddTextString() function in     transform.c due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause an out-of-bounds write, resulting in the     execution of arbitrary code. (CVE-2017-5029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iTunes installed on the remote Windows host is prior to 12.6. It is, therefore, affected by multiple vulnerabilities :

  - Multiple vulnerabilities exist in the expat component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2009-3270,     CVE-2009-3560, CVE-2009-3720, CVE-2012-1147,     CVE-2012-1148, CVE-2012-6702, CVE-2015-1283,     CVE-2016-0718, CVE-2016-4472, CVE-2016-5300)

  - Multiple vulnerabilities exist in the SQLite component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities by convincing a user to     open a specially crafted file, to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2013-7443,     CVE-2015-3414, CVE-2015-3415, CVE-2015-3416,     CVE-2015-3717, CVE-2015-6607, CVE-2016-6153)

  - An information disclosure vulnerability exists in the     APNs server component due to client certificates being     transmitted in cleartext. A man-in-the-middle attacker     can exploit this to disclose sensitive information.
    (CVE-2017-2383)

  - A use-after-free error exists in the WebKit component     due to improper handling of RenderBox objects. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-2463)

  - Multiple universal cross-site scripting (XSS)     vulnerabilities exist in the WebKit component due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these     vulnerabilities, by convincing a user to visit a     specially crafted web page, to execute arbitrary script     code in a user's browser session. (CVE-2017-2479,     CVE-2017-2480, CVE-2017-2493)

  - An integer overflow condition exists in the libxslt     component in the xsltAddTextString() function in     transform.c due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause an out-of-bounds write, resulting in the     execution of arbitrary code. (CVE-2017-5029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201701-21 (Expat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Expat. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by enticing a user to process a specially crafted XML       file, could execute arbitrary code with the privileges of the process or       cause a Denial of Service condition.  This attack could also be used       against automated systems that arbitrarily process XML files.
  Workaround :

    There is no known workaround at this time.

The version of Tenable Passive Vulnerability Scanner (PVS) installed on the remote host is 5.x < 5.2.0. It is, therefore, affected by multiple vulnerabilities :

  - Multiple denial of service vulnerabilities exist in     Expat within file xmlparse.c due to a logical error in     hash computations. An unauthenticated, remote attacker     can exploit these, via a specially crafted XML file     containing many identifiers with the same value, to     cause the service to exhaust CPU resources.
    (CVE-2012-0876, CVE-2016-5300)

  - A flaw exists in the generate_hash_secret_salt()     function in file lib/xmlparse.c within Expat due to the     generation of non-random output by the PRNG. An     unauthenticated, remote attacker can exploit this to     more easily predict the PRNG output. (CVE-2012-6702)

  - Multiple buffer overflow conditions exist within Expat,     specifically in the XML_GetBuffer() function in file     lib/xmlparse.c, due to improper validation of     user-supplied input when handling compressed XML     content. An unauthenticated, remote attacker can exploit     these to execute arbitrary code. (CVE-2015-1283,     CVE-2016-4472)

  - Multiple buffer overflow conditions exist within the     Expat XML parser when handling malformed input documents     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-0718, CVE-2016-0719)

  - Multiple integer overflow conditions exist in s3_srvr.c,     ssl_sess.c, and t1_lib.c due to improper use of pointer     arithmetic for heap-buffer boundary checks. An     unauthenticated, remote attacker can exploit these to     cause a denial of service. (CVE-2016-2177)

  - An information disclosure vulnerability exists in the     dsa_sign_setup() function in dsa_ossl.c due to a failure     to properly ensure the use of constant-time operations.
    An unauthenticated, remote attacker can exploit this,     via a timing side-channel attack, to disclose DSA key     information. (CVE-2016-2178)

  - A denial of service vulnerability exists in the DTLS     implementation due to a failure to properly restrict the     lifetime of queue entries associated with unused     out-of-order messages. An unauthenticated, remote     attacker can exploit this, by maintaining multiple     crafted DTLS sessions simultaneously, to exhaust memory.
    (CVE-2016-2179)

  - An out-of-bounds read error exists in the X.509 Public     Key Infrastructure Time-Stamp Protocol (TSP)     implementation. An unauthenticated, remote attacker can     exploit this, via a crafted time-stamp file that is     mishandled by the 'openssl ts' command, to cause     denial of service or to disclose sensitive information.
    (CVE-2016-2180)

  - A denial of service vulnerability exists in the     Anti-Replay feature in the DTLS implementation due to     improper handling of epoch sequence numbers in records.
    An unauthenticated, remote attacker can exploit this,     via spoofed DTLS records, to cause legitimate packets to     be dropped. (CVE-2016-2181)

  - An overflow condition exists in the BN_bn2dec() function     in bn_print.c due to improper validation of     user-supplied input when handling BIGNUM values. An     unauthenticated, remote attacker can exploit this to     crash the process. (CVE-2016-2182)

  - A vulnerability exists, known as SWEET32, in the 3DES     and Blowfish algorithms due to the use of weak 64-bit     block ciphers by default. A man-in-the-middle attacker     who has sufficient resources can exploit this     vulnerability, via a 'birthday' attack, to detect a     collision that leaks the XOR between the fixed secret     and a known plaintext, allowing the disclosure of the     secret text, such as secure HTTPS cookies, and possibly     resulting in the hijacking of an authenticated session.
    (CVE-2016-2183)

  - A flaw exists in SQLite due to the use of insecure     temporary directories. A local attacker can exploit this     to cause a denial of service condition or possibly have     other more severe impact. (CVE-2016-6153)

  - A flaw exists in the tls_decrypt_ticket() function in     t1_lib.c due to improper handling of ticket HMAC     digests. An unauthenticated, remote attacker can exploit     this, via a ticket that is too short, to crash the     process, resulting in a denial of service.
    (CVE-2016-6302)

  - An integer overflow condition exists in the     MDC2_Update() function in mdc2dgst.c due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a heap-based     buffer overflow, resulting in a denial of service     condition or possibly the execution of arbitrary code.
    (CVE-2016-6303)

  - A flaw exists in the ssl_parse_clienthello_tlsext()     function in t1_lib.c due to improper handling of overly     large OCSP Status Request extensions from clients. An     unauthenticated, remote attacker can exploit this, via     large OCSP Status Request extensions, to exhaust memory     resources, resulting in a denial of service condition.
    (CVE-2016-6304)

  - A flaw exists in the SSL_peek() function in     rec_layer_s3.c due to improper handling of empty     records. An unauthenticated, remote attacker can exploit     this, by triggering a zero-length record in an SSL_peek     call, to cause an infinite loop, resulting in a denial     of service condition. (CVE-2016-6305)

  - An out-of-bounds read error exists in the certificate     parser that allows an unauthenticated, remote attacker     to cause a denial of service via crafted certificate     operations. (CVE-2016-6306)

  - A denial of service vulnerability exists in the     state-machine implementation due to a failure to check     for an excessive length before allocating memory. An     unauthenticated, remote attacker can exploit this, via a     crafted TLS message, to exhaust memory resources.
    (CVE-2016-6307)

  - A denial of service vulnerability exists in the DTLS     implementation due to improper handling of excessively     long DTLS messages. An unauthenticated, remote attacker     can exploit this, via a crafted DTLS message, to exhaust     available memory resources. (CVE-2016-6308)

  - A remote code execution vulnerability exists in the     read_state_machine() function in statem.c due to     improper handling of messages larger than 16k. An     unauthenticated, remote attacker can exploit this, via a     specially crafted message, to cause a use-after-free     error, resulting in a denial of service condition or     possibly the execution of arbitrary code.
    (CVE-2016-6309)

  - A cross-site scripting (XSS) vulnerability exists within     the JQuery UI dialog() function due to improper     validation of input to the 'closeText' parameter before     returning it to users. An unauthenticated, remote     attacker can exploit this, via a specially crafted     request, to execute arbitrary script code in a user's     browser session. (CVE-2016-7103)

  - A denial of service vulnerability exists in x509_vfy.c     due to improper handling of certificate revocation lists     (CRLs). An unauthenticated, remote attacker can exploit     this, via a specially crafted CRL, to cause a NULL     pointer dereference, resulting in a crash of the     service. (CVE-2016-7052)

  - An unspecified cross-site scripting (XSS) vulnerability     exists in the web interface due to improper validation     of input before returning it to users. An     unauthenticated, remote attacker can exploit this, via a     specially crafted request, to execute arbitrary script     code in a user's browser session.

New expat packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.

Security fixes for CVE-2016-4472, CVE-2016-5300, CVE-2016-0718 and CVE-2012-6702.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Adam Maris reports :

It was found that original patch for issues CVE-2015-1283 and CVE-2015-2716 used overflow checks that could be optimized out by some compilers applying certain optimization settings, which can cause the vulnerability to remain even after applying the patch.

It was discovered that the Expat code in XML-RPC for C and C++ unexpectedly called srand in certain circumstances. This could reduce the security of calling applications. (CVE-2012-6702)

It was discovered that the Expat code in XML-RPC for C and C++ incorrectly handled seeding the random number generator. A remote attacker could possibly use this issue to cause a denial of service.
(CVE-2016-5300)

Gustavo Grieco discovered that the Expat code in XML-RPC for C and C++ incorrectly handled malformed XML data. If a user or application linked against XML-RPC for C and C++ were tricked into opening a crafted XML file, an attacker could cause a denial of service, or possibly execute arbitrary code. (CVE-2016-0718)

It was discovered that the Expat code in XML-RPC for C and C++ incorrectly handled malformed XML data. If a user or application linked against XML-RPC for C and C++ were tricked into opening a crafted XML file, an attacker could cause a denial of service, or possibly execute arbitrary code. (CVE-2015-1283, CVE-2016-4472).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Gustavo Grieco discovered that Expat, an XML parsing C library, does not properly handle certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. A remote attacker can take advantage of this flaw to cause an application using the Expat library to crash, or potentially, to execute arbitrary code with the privileges of the user running the application.

ID	Name	Product	Family	Severity
129256	EulerOS 2.0 SP3 : expat (EulerOS-SA-2019-2063)	Nessus	Huawei Local Security Checks	high
126869	EulerOS 2.0 SP2 : expat (EulerOS-SA-2019-1742)	Nessus	Huawei Local Security Checks	high
126540	EulerOS Virtualization for ARM 64 3.0.2.0 : expat (EulerOS-SA-2019-1698)	Nessus	Huawei Local Security Checks	high
126293	EulerOS 2.0 SP5 : expat (EulerOS-SA-2019-1666)	Nessus	Huawei Local Security Checks	high
109594	FreeBSD : python 2.7 -- multiple vulnerabilities (8719b935-8bae-41ad-92ba-3c826f651219)	Nessus	FreeBSD Local Security Checks	high
109583	Slackware 14.0 / 14.1 / 14.2 / current : python (SSA:2018-124-01)	Nessus	Slackware Local Security Checks	high
103796	FreeBSD : Python 2.7 -- multiple vulnerabilities (9164f51e-ae20-11e7-a633-009c02a2ab30)	Nessus	FreeBSD Local Security Checks	high
103424	Slackware 14.0 / 14.1 / 14.2 / current : python (SSA:2017-266-02)	Nessus	Slackware Local Security Checks	high
100027	Apple iTunes < 12.6 Multiple Vulnerabilities (macOS) (credentialed check)	Nessus	MacOS X Local Security Checks	high
100026	Apple iTunes < 12.6 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	high
100025	Apple iTunes < 12.6 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	high
96415	GLSA-201701-21 : Expat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
96337	Tenable Passive Vulnerability Scanner 5.x < 5.2.0 Multiple Vulnerabilities (SWEET32)	Nessus	Misc.	critical
96092	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : expat (SSA:2016-359-01)	Nessus	Slackware Local Security Checks	high
92229	Fedora 22 : expat (2016-0fd6ca526a)	Nessus	Fedora Local Security Checks	high
92117	Fedora 24 : expat (2016-7c6e7a9265)	Nessus	Fedora Local Security Checks	high
92102	Fedora 23 : expat (2016-60889583ab)	Nessus	Fedora Local Security Checks	high
91913	FreeBSD : expat2 -- denial of service (ff76f0e0-3f11-11e6-b3c8-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	medium
91729	Ubuntu 12.04 LTS : xmlrpc-c vulnerabilities (USN-3013-1)	Nessus	Ubuntu Local Security Checks	high
91200	Debian DSA-3582-1 : expat - security update	Nessus	Debian Local Security Checks	high

CVE-2016-4472

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Configuration 2

Tenable Plugins