parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.

parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
    (CVE-2017-16932)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3739-1 advisory.

    Matias Brutti discovered that libxml2 incorrectly handled certain XML files. An attacker could possibly     use this issue to expose sensitive information. (CVE-2016-9318)

    It was discovered that libxml2 incorrectly handled certain files. An attacker could possibly use this     issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2017-16932)

    It was discovered that libxml2 incorrectly handled certain files. An attacker could possibly use this     issue to cause a denial of service. (CVE-2017-18258, CVE-2018-14404, CVE-2018-14567)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1833-1 advisory.

  - parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
    (CVE-2017-16932)

  - In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*)     don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a     victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for     example libxslt through 1.1.35, is affected as well. (CVE-2022-29824)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2972 advisory.

    Five security issues have been discovered in libxml2: XML C parser and toolkit. CVE-2016-9318 Vulnerable     versions do not offer a flag directly indicating that the current document may be read but other files may     not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via     a crafted document. CVE-2017-5130 Integer overflow in memory debug code, allowed a remote attacker to     potentially exploit heap corruption via a crafted XML file. CVE-2017-5969 Parser in a recover mode allows     remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document.
    CVE-2017-16932 When expanding a parameter entity in a DTD, infinite recursion could lead to an infinite     loop or memory exhaustion. CVE-2022-23308 the application that validates XML using xmlTextReaderRead()     with XML_PARSE_DTDATTR and XML_PARSE_DTDVALID enabled becomes vulnerable to this use-after-free bug. This     issue can result in denial of service. For Debian 9 stretch, these problems have been fixed in version     2.9.4+dfsg1-2.2+deb9u6. We recommend that you upgrade your libxml2 packages. For the detailed security     status of libxml2 please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/libxml2 Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A remote code execution vulnerability in libxml2 could     enable an attacker using a specially crafted file to     execute arbitrary code within the context of an     unprivileged process. This issue is rated as High due     to the possibility of remote code execution in an     application that uses this library. Product: Android.
    Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1,     7.1.2. Android ID: A-37104170.(CVE-2017-0663)

  - parser.c in libxml2 before 2.9.5 mishandles     parameter-entity references because the NEXTL macro     calls the xmlParserHandlePEReference function in the     case of a '%' character in a DTD name.(CVE-2017-16931)

  - parser.c in libxml2 before 2.9.5 does not prevent     infinite recursion in parameter     entities.(CVE-2017-16932)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its version, the ClamAV clamd antivirus daemon running on the remote host is prior to 0.100.1. It is, therefore, affected by multiple vulnerabilities.

Joel Esler reports :

3 security fixes in this release :

- CVE-2017-16932: Vulnerability in libxml2 dependency (affects ClamAV on Windows only).

- CVE-2018-0360: HWP integer overflow, infinite loop vulnerability.
Reported by Secunia Research at Flexera.

- CVE-2018-0361: ClamAV PDF object length check, unreasonably long time to parse relatively small file. Report ed by aCaB.

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Use-after-free vulnerability in libxml2 through 2.9.4,     as used in Google Chrome before 52.0.2743.82, allows     remote attackers to cause a denial of service or     possibly have unspecified other impact via vectors     related to the XPointer range-to     function.(CVE-2016-5131)

  - parser.c in libxml2 before 2.9.5 mishandles     parameter-entity references because the NEXTL macro     calls the xmlParserHandlePEReference function in the     case of a '%' character in a DTD name.(CVE-2017-16931)

  - parser.c in libxml2 before 2.9.5 does not prevent     infinite recursion in parameter     entities.)CVE-2017-16932)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Use-after-free vulnerability in libxml2 through 2.9.4,     as used in Google Chrome before 52.0.2743.82, allows     remote attackers to cause a denial of service or     possibly have unspecified other impact via vectors     related to the XPointer range-to     function.(CVE-2016-5131)

  - parser.c in libxml2 before 2.9.5 mishandles     parameter-entity references because the NEXTL macro     calls the xmlParserHandlePEReference function in the     case of a '%' character in a DTD name.(CVE-2017-16931)

  - parser.c in libxml2 before 2.9.5 does not prevent     infinite recursion in parameter     entities.)CVE-2017-16932)

  - A flaw in libxml2 allows remote XML entity inclusion     with default parser flags (i.e., when the caller did     not request entity substitution, DTD validation,     external DTD subset loading, or default DTD     attributes). Depending on the context, this may expose     a higher-risk attack surface in libxml2 not usually     reachable with default parser flags, and expose content     from local files, HTTP, or FTP servers (which might be     otherwise unreachable).(CVE-2017-7375)

  - Buffer overflow in libxml2 allows remote attackers to     execute arbitrary code by leveraging an incorrect limit     for port values when handling redirects.(CVE-2017-7376)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libxml2 fixes several issues. Theses security issues were fixed :

  - CVE-2017-16932: Fixed infinite recursion could lead to     an infinite loop or memory exhaustion when expanding a     parameter entity in a DTD (bsc#1069689).

  - CVE-2017-15412: Prevent use after free when calling     XPath extension functions that allowed remote attackers     to cause DoS or potentially RCE (bsc#1077993)

  - CVE-2016-5131: Use-after-free vulnerability in libxml2     allowed remote attackers to cause a denial of service or     possibly have unspecified other impact via vectors     related to the XPointer range-to function. (bsc#1078813)

  - CVE-2017-5130: Fixed a potential remote buffer overflow     in function xmlMemoryStrdup() (bsc#1078806)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3504-1 advisory.

    Wei Lei discovered that libxml2 incorrecty handled certain parameter entities. An attacker could use this     issue with specially constructed XML data to cause libxml2 to consume resources, leading to a denial of     service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

CVE-2017-16931 parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.

CVE-2017-16932 parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.

For Debian 7 'Wheezy', these problems have been fixed in version 2.8.0+dfsg1-7+wheezy11.

We recommend that you upgrade your libxml2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
504324	Siemens SIMATIC S7-1500 Loop with Unreachable Exit Condition (CVE-2017-16932)	Tenable OT Security	Tenable.ot	high
221114	Linux Distros Unpatched Vulnerability : CVE-2017-16932	Nessus	Misc.	high
183608	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : libxml2 vulnerabilities (USN-3739-1)	Nessus	Ubuntu Local Security Checks	medium
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	critical
161498	SUSE SLES12 Security Update : libxml2 (SUSE-SU-2022:1833-1)	Nessus	SuSE Local Security Checks	high
159615	Debian DLA-2972-1 : libxml2 - LTS security update	Nessus	Debian Local Security Checks	high
117567	EulerOS Virtualization 2.5.0 : libxml2 (EulerOS-SA-2018-1258)	Nessus	Huawei Local Security Checks	critical
117566	EulerOS Virtualization 2.5.1 : libxml2 (EulerOS-SA-2018-1257)	Nessus	Huawei Local Security Checks	critical
111517	ClamAV < 0.100.1 Multiple Vulnerabilities	Nessus	Misc.	high
110970	FreeBSD : clamav -- multiple vulnerabilities (d1e9d8c5-839b-11e8-9610-9c5c8e75236a)	Nessus	FreeBSD Local Security Checks	high
110732	EulerOS 2.0 SP3 : libxml2 (EulerOS-SA-2018-1156)	Nessus	Huawei Local Security Checks	critical
109487	EulerOS 2.0 SP2 : libxml2 (EulerOS-SA-2018-1089)	Nessus	Huawei Local Security Checks	critical
109486	EulerOS 2.0 SP1 : libxml2 (EulerOS-SA-2018-1088)	Nessus	Huawei Local Security Checks	critical
106707	SUSE SLES11 Security Update : libxml2 (SUSE-SU-2018:0395-1)	Nessus	SuSE Local Security Checks	high
105037	Ubuntu 14.04 LTS / 16.04 LTS : libxml2 vulnerability (USN-3504-1)	Nessus	Ubuntu Local Security Checks	high
104936	Debian DLA-1194-1 : libxml2 security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2017-16932

high

Tenable Plugins

high

high

medium

critical

high

high

critical

critical

high

high

critical

critical

critical

high

high

critical