A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did
    not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes).
    Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable
    with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be
    otherwise unreachable). (CVE-2017-7375)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1777464764 advisory.

  - A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did     not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes).
    Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable     with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be     otherwise unreachable). (CVE-2017-7375)

  - A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2     through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case.
    Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable     to a denial of service attack due to a crash of the application. (CVE-2018-14404)

  - xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to     newDoc->oldNs. (CVE-2019-19956)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher- risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did     not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes).
    Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable     with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be     otherwise unreachable). (CVE-2017-7375)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

According to its self-reported version number, the remote Juniper Junos device is affected by a Multiple vulnerabilities in libxml2:

- Format string vulnerability in libxml2 before 2.9.4 allows   attackers to have unspecified impact via format string   specifiers in unknown vectors.(CVE-2016-4448)   
- The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and   earlier, when used in recovery mode, allows context-dependent   attackers to cause a denial of service (infinite recursion, stack   consumption, and application crash) via a crafted XML document.   (CVE-2016-3627)

According to the version of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A flaw in libxml2 allows remote XML entity inclusion     with default parser flags (i.e., when the caller did     not request entity substitution, DTD validation,     external DTD subset loading, or default DTD     attributes). Depending on the context, this may expose     a higher-risk attack surface in libxml2 not usually     reachable with default parser flags, and expose content     from local files, HTTP, or FTP servers (which might be     otherwise unreachable).(CVE-2017-7375)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Use-after-free vulnerability in libxml2 through 2.9.4,     as used in Google Chrome before 52.0.2743.82, allows     remote attackers to cause a denial of service or     possibly have unspecified other impact via vectors     related to the XPointer range-to     function.(CVE-2016-5131)

  - parser.c in libxml2 before 2.9.5 mishandles     parameter-entity references because the NEXTL macro     calls the xmlParserHandlePEReference function in the     case of a '%' character in a DTD name.(CVE-2017-16931)

  - parser.c in libxml2 before 2.9.5 does not prevent     infinite recursion in parameter     entities.)CVE-2017-16932)

  - A flaw in libxml2 allows remote XML entity inclusion     with default parser flags (i.e., when the caller did     not request entity substitution, DTD validation,     external DTD subset loading, or default DTD     attributes). Depending on the context, this may expose     a higher-risk attack surface in libxml2 not usually     reachable with default parser flags, and expose content     from local files, HTTP, or FTP servers (which might be     otherwise unreachable).(CVE-2017-7375)

  - Buffer overflow in libxml2 allows remote attackers to     execute arbitrary code by leveraging an incorrect limit     for port values when handling redirects.(CVE-2017-7376)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An integer overflow in xmlmemory.c in libxml2 before     2.9.5, as used in Google Chrome prior to 62.0.3202.62     and other products, allowed a remote attacker to     potentially exploit heap corruption via a crafted XML     file.(CVE-2017-5130)

  - libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a     heap-based buffer over-read in the     xmlDictComputeFastKey function in dict.c. This     vulnerability causes programs that use libxml2, such as     PHP, to crash. (CVE-2017-9049)

  - A flaw in libxml2 allows remote XML entity inclusion     with default parser flags (i.e., when the caller did     not request entity substitution, DTD validation,     external DTD subset loading, or default DTD     attributes). Depending on the context, this may expose     a higher-risk attack surface in libxml2 not usually     reachable with default parser flags, and expose content     from local files, HTTP, or FTP servers (which might be     otherwise unreachable).(CVE-2017-7375)

  - Buffer overflow in libxml2 allows remote attackers to     execute arbitrary code by leveraging an incorrect limit     for port values when handling redirects.(CVE-2017-7376)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201711-01 (libxml2: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libxml2. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by enticing a user to process a specially crafted XML       document, could remotely execute arbitrary code, conduct XML External       Entity (XXE) attacks, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3424-1 advisory.

    It was discovered that a type confusion error existed in libxml2. An attacker could use this to specially     construct XML data that could cause a denial of service or possibly execute arbitrary code.
    (CVE-2017-0663)

    It was discovered that libxml2 did not properly validate parsed entity references. An attacker could use     this to specially construct XML data that could expose sensitive information. (CVE-2017-7375)

    It was discovered that a buffer overflow existed in libxml2 when handling HTTP redirects. An attacker     could use this to specially construct XML data that could cause a denial of service or possibly execute     arbitrary code. (CVE-2017-7376)

    Marcel Bhme and Van-Thuan Pham discovered a buffer overflow in libxml2 when handling elements. An     attacker could use this to specially construct XML data that could cause a denial of service or possibly     execute arbitrary code. (CVE-2017-9047)

    Marcel Bhme and Van-Thuan Pham discovered a buffer overread in libxml2 when handling elements. An     attacker could use this to specially construct XML data that could cause a denial of service.
    (CVE-2017-9048)

    Marcel Bhme and Van-Thuan Pham discovered multiple buffer overreads in libxml2 when handling parameter-     entity references. An attacker could use these to specially construct XML data that could cause a denial     of service. (CVE-2017-9049, CVE-2017-9050)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause a denial-of-service against the application, information leaks, or potentially, the execution of arbitrary code with the privileges of the user running the application.

This update for libxml2 fixes the following issues: Security issues fixed :

  - CVE-2017-0663: Fixed a heap buffer overflow in xmlAddID     (bsc#1044337)

  - CVE-2017-5969: Fixed a NULL pointer deref in     xmlDumpElementContent (bsc#1024989)

  - CVE-2017-7375: Prevented an unwanted external entity     reference (bsc#1044894)

  - CVE-2017-7376: Increase buffer space for port in HTTP     redirect support (bsc#1044887)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libxml2 fixes the following issues :

Security issues fixed :

  - CVE-2017-7376: Increase buffer space for port in HTTP     redirect support (bsc#1044887)

  - CVE-2017-7375: Prevent unwanted external entity     reference (bsc#1044894)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for libxml2 fixes the following issues: Security issues fixed :

  - CVE-2017-7376: Increase buffer space for port in HTTP     redirect support (bsc#1044887)

  - CVE-2017-7375: Prevent unwanted external entity     reference [bsc#1044894, ]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2017-7375 Missing validation for external entities in xmlParsePEReference

CVE-2017-9047 CVE-2017-9048 A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about 'size' many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.

CVE-2017-9049 CVE-2017-9050 libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.

For Debian 7 'Wheezy', these problems have been fixed in version 2.8.0+dfsg1-7+wheezy8.

We recommend that you upgrade your libxml2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
476493	Echo: libxml2-2.9.1: security update to 2.9.1+e1	Tenable Cloud Security	Echo Local Security Checks	Local	critical
476493	Echo: libxml2-2.9.1: security update to 2.9.1+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
352816	CentOS Linux 6 [TuxCare] Security Update: libxml2 / libxml2-devel / libxml2-python / libxml2-static Multiple Vulnerabilities (CENTOS6:CLSA-2026:1777464764)	Nessus	CentOS Local Security Checks	Local	critical
504322	Siemens SIMATIC S7-1500 Improper Restriction of XML External Entity Reference (CVE-2017-7375)	Tenable OT Security	Tenable.ot	Remote	critical
221628	Linux Distros Unpatched Vulnerability : CVE-2017-7375	Nessus	Misc.	Local	critical
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	Local	critical
121070	Junos OS: Multiple vulnerabilities in libxml2 (JSA10916)	Nessus	Junos Local Security Checks	Combined	critical
118424	EulerOS Virtualization 2.5.0 : libxml2 (EulerOS-SA-2018-1336)	Nessus	Huawei Local Security Checks	Local	critical
109487	EulerOS 2.0 SP2 : libxml2 (EulerOS-SA-2018-1089)	Nessus	Huawei Local Security Checks	Local	critical
108474	EulerOS 2.0 SP1 : libxml2 (EulerOS-SA-2018-1070)	Nessus	Huawei Local Security Checks	Local	critical
104492	GLSA-201711-01 : libxml2: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
103327	Ubuntu 14.04 LTS / 16.04 LTS : libxml2 vulnerabilities (USN-3424-1)	Nessus	Ubuntu Local Security Checks	Local	critical
102685	Debian DSA-3952-1 : libxml2 - security update	Nessus	Debian Local Security Checks	Local	critical
101351	SUSE SLES11 Security Update : libxml2 (SUSE-SU-2017:1813-1)	Nessus	SuSE Local Security Checks	Local	critical
101288	openSUSE Security Update : libxml2 (openSUSE-2017-793)	Nessus	SuSE Local Security Checks	Local	critical
101203	SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2017:1743-1)	Nessus	SuSE Local Security Checks	Local	critical
101174	Debian DLA-1008-1 : libxml2 security update	Nessus	Debian Local Security Checks	Local	critical

Detections

Analytics

CVE-2017-7375

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical