In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized     read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack     contains the characters A, a, I, i, or 0, or any other character. (CVE-2019-13117)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of AOS installed on the remote host is prior to 7.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.0.1 advisory.

  - BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many     selectors. (CVE-2019-12900)

  - A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can     trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs,     the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result     in leaked passwords, such as those found in /etc/shadow while performing authentications. (CVE-2024-10041)

  - A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as     hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname,     gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who     can access certain services or terminals. (CVE-2024-10963)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2024-21131)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2024-21138)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.8.1.7. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.8.1.7 advisory.

  - BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many     selectors. (CVE-2019-12900)

  - A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can     trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs,     the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result     in leaked passwords, such as those found in /etc/shadow while performing authentications. (CVE-2024-10041)

  - A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as     hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname,     gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who     can access certain services or terminals. (CVE-2024-10963)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2024-21131)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2024-21138)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.10.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.10.1 advisory.

  - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer     overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)

  - BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many     selectors. (CVE-2019-12900)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2024-21131)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2024-21138)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE,     Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from     the internet) and rely on the Java sandbox for security. (CVE-2024-21140)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.0.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.0.0.5 advisory.

  - BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many     selectors. (CVE-2019-12900)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2024-21131)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2024-21138)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE,     Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from     the internet) and rely on the Java sandbox for security. (CVE-2024-21140)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Concurrency). Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf,     11.0.23; Oracle GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from     the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2024-21144)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

The version of Amazon Corretto installed on the remote host is prior to 8 < 8.242.07.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-8-2020-Jan-14 advisory.

  - OpenJFX (libxslt) (CVE-2019-13117, CVE-2019-13118)

  - OpenJFX (SQLite) (CVE-2019-16168)

  - Serialization (CVE-2020-2583, CVE-2020-2604)

  - OpenJFX (CVE-2020-2585)

  - Security (CVE-2020-2590, CVE-2020-2601)

  - Networking (CVE-2020-2593, CVE-2020-2659)

  - Libraries (CVE-2020-2654)

  - JSSE (CVE-2020-2655)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libxslt fixes the following issues :

Security issues fixed :

CVE-2019-13118: Fixed a read of uninitialized stack data (bsc#1140101).

CVE-2019-13117: Fixed a uninitialized read which allowed to discern whether a byte on the stack contains certain special characters (bsc#1140095).

CVE-2019-18197: Fixed a dangling pointer in xsltCopyText which may have led to information disclosure (bsc#1154609).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libxslt fixes the following issues :

Security issues fixed :

  - CVE-2019-13118: Fixed a read of uninitialized stack data     (bsc#1140101).

  - CVE-2019-13117: Fixed a uninitialized read which allowed     to discern whether a byte on the stack contains certain     special characters (bsc#1140095).

  - CVE-2019-18197: Fixed a dangling pointer in xsltCopyText     which may have led to information disclosure     (bsc#1154609).

This update was imported from the SUSE:SLE-15:Update update project.

According to the versions of the libxslt packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In numbers.c in libxslt 1.1.33, a type holding grouping     characters of an xsl:number instruction was too narrow     and an invalid character/length combination could be     passed to xsltNumberFormatDecimal, leading to a read of     uninitialized stack data.(CVE-2019-13118)

  - In numbers.c in libxslt 1.1.33, an xsl:number with     certain format strings could lead to a uninitialized     read in xsltNumberFormatInsertNumbers. This could allow     an attacker to discern whether a byte on the stack     contains the characters A, a, I, i, or 0, or any other     character.(CVE-2019-13117)

  - numbers.c in libxslt before 1.1.29, as used in Google     Chrome before 51.0.2704.63, mishandles the i format     token for xsl:number data, which allows remote     attackers to cause a denial of service (integer     overflow or resource consumption) or possibly have     unspecified other impact via a crafted     document.(CVE-2016-1684)

  - numbers.c in libxslt before 1.1.29, as used in Google     Chrome before 51.0.2704.63, mishandles namespace nodes,     which allows remote attackers to cause a denial of     service (out-of-bounds heap memory access) or possibly     have unspecified other impact via a crafted     document.(CVE-2016-1683)

  - The xsltStylePreCompute function in preproc.c in     libxslt 1.1.28 does not check if the parent node is an     element, which allows attackers to cause a denial of     service via a crafted XML file, related to a 'type     confusion' issue.(CVE-2015-7995)

  - In xsltCopyText in transform.c in libxslt 1.1.33, a     pointer variable isn't reset under certain     circumstances. If the relevant memory area happened to     be freed and reused in a certain way, a bounds check     could fail and memory outside a buffer could be written     to, or uninitialized data could be     disclosed.(CVE-2019-18197)

  - Type confusion in xsltNumberFormatGetMultipleLevel     prior to libxslt 1.1.33 could allow attackers to     potentially exploit heap corruption via crafted XML     data.(CVE-2019-5815)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.6+10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1387 advisory.

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). (CVE-2020-2590)

    In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too     narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to     a read of uninitialized stack data. (CVE-2019-13118)

    Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle GraalVM (component: Java). The     supported version that is affected is 19.3.0.2. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle GraalVM Enterprise Edition.
    Successful attacks of this vulnerability can result in takeover of Oracle GraalVM Enterprise Edition.
    Note: GraalVM Enterprise 19.3 and above includes both Java SE 8 and Java SE 11. CVSS 3.0 Base Score 8.1     (Confidentiality, Integrity and Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).  (CVE-2020-2604)

    Vulnerability in the Java SE product of Oracle Java SE (component: JavaFX). The supported version that is     affected is Java SE: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can     result in unauthorized creation, deletion or modification access to critical data or all Java SE     accessible data. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run     untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service     which supplies data to the APIs. CVSS 3.0 Base Score 5.9 (Integrity impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N). (CVE-2020-2585)

    Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are     affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful     attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service     (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the     specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as     through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2020-2654)

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to     compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may     significantly impact additional products. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N). (CVE-2020-2601)

    Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are     affected are Java SE: 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access to some of Java SE accessible data as well as     unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the     Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8     (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
    (CVE-2020-2655)

    In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application     because of missing validation of a sqlite_stat1 sz field, aka a severe division by zero in the query     planner. (CVE-2019-16168)

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking).
    Supported versions that are affected are Java SE: 7u241 and 8u231; Java SE Embedded: 8u231. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2020-2659)

    In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized     read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack     contains the characters A, a, I, i, or 0, or any other character. (CVE-2019-13117)

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded:
    8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2020-2583)

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking).
    Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded:
    8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well     as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). (CVE-2020-2593)



Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 7 Update 251, 8 Update 241, 11 Update 6, or 13 Update 2. It is, therefore, affected by multiple vulnerabilities:

  - Oracle Java SE and Java SE Embedded are prone to a severe division by zero, over 'Multiple' protocol.
    This issue affects the 'SQLite' component.(CVE-2019-16168)

  - Oracle Java SE and Java SE Embedded are prone to format string vulnerability, leading to a read     uninitialized stack data over 'Multiple' protocol. This issue affects the 'libxst' component.
    (CVE-2019-13117, CVE-2019-13118)

  - Oracle Java SE and Java SE Embedded are prone to a remote security vulnerability. An unauthenticated     remote attacker can exploit this over 'Kerberos' protocol. This issue affects the 'Security' component.
    (CVE-2020-2601, CVE-2020-2590)

  - Oracle Java SE/Java SE Embedded are prone to a remote security vulnerability. An unauthenticated     remote attacker can exploit this overmultiple protocols. This issue affects the 'Serialization' component.
    (CVE-2020-2604, CVE-2020-2583)

  - Oracle Java SE/Java SE Embedded are prone to a remote security vulnerability. Tn unauthenticated     remote attacker can exploit this over multiple protocols. This issue affects the 'Networking' component.
    (CVE-2020-2593, CVE-2020-2659)

  - Oracle Java SE are prone to a remote security vulnerability. An unauthenticated remote attacker can exploit     this over multiple protocols. This issue affects the 'Libraries' component. (CVE-2020-2654)

  - Oracle Java SE are prone to a multiple security vulnerability. An unauthenticated remote attacker can exploit     this over multiple protocols. This issue affects the 'JavaFX' component. (CVE-2020-2585)

  - Oracle Java SE are prone to a multiple security vulnerability. An unauthenticate remote attacker can exploit     this over 'HTTPS' protocols. This issue affects the 'JSSE' component. (CVE-2020-2655)

Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libxslt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In numbers.c in libxslt 1.1.33, a type holding grouping     characters of an xsl:number instruction was too narrow     and an invalid character/length combination could be     passed to xsltNumberFormatDecimal, leading to a read of     uninitialized stack data.(CVE-2019-13118)

  - In numbers.c in libxslt 1.1.33, an xsl:number with     certain format strings could lead to a uninitialized     read in xsltNumberFormatInsertNumbers. This could allow     an attacker to discern whether a byte on the stack     contains the characters A, a, I, i, or 0, or any other     character.(CVE-2019-13117)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libxslt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - This C library allows to transform XML files into other     XML files (or HTML, text, ...) using the standard XSLT     stylesheet transformation mechanism. To use it you need     to have a version of libxml2 i1/4z= 2.6.27 installed. The     xsltproc command is a command line interface to the     XSLT engine.Security Fix(es):In xsltCopyText in     transform.c in libxslt 1.1.33, a pointer variable isn't     reset under certain circumstances. If the relevant     memory area happened to be freed and reused in a     certain way, a bounds check could fail and memory     outside a buffer could be written to, or uninitialized     data could be disclosed.(CVE-2019-18197)The     xsltStylePreCompute function in preproc.c in libxslt     1.1.28 does not check if the parent node is an element,     which allows attackers to cause a denial of service via     a crafted XML file, related to a 'type confusion'     issue.(CVE-2015-7995)numbers.c in libxslt before     1.1.29, as used in Google Chrome before 51.0.2704.63,     mishandles namespace nodes, which allows remote     attackers to cause a denial of service (out-of-bounds     heap memory access) or possibly have unspecified other     impact via a crafted document.(CVE-2016-1683)numbers.c     in libxslt before 1.1.29, as used in Google Chrome     before 51.0.2704.63, mishandles the i format token for     xsl:number data, which allows remote attackers to cause     a denial of service (integer overflow or resource     consumption) or possibly have unspecified other impact     via a crafted document.(CVE-2016-1684)libxslt in Apple     iOS before 9.3.3, OS X before 10.11.6, iTunes before     12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS     before 9.2.2, and watchOS before 2.2.2 allows remote     attackers to cause a denial of service (memory     corruption) or possibly have unspecified other impact     via unknown vectors, a different vulnerability than     CVE-2016-4608, CVE-2016-4609, CVE-2016-4610, and     CVE-2016-4612.(CVE-2016-4607)libxslt in Apple iOS     before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2     on Windows, iCloud before 5.2.1 on Windows, tvOS before     9.2.2, and watchOS before 2.2.2 allows remote attackers     to cause a denial of service (memory corruption) or     possibly have unspecified other impact via unknown     vectors, a different vulnerability than CVE-2016-4607,     CVE-2016-4609, CVE-2016-4610, and     CVE-2016-4612.(CVE-2016-4608)libxslt in Apple iOS     before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2     on Windows, iCloud before 5.2.1 on Windows, tvOS before     9.2.2, and watchOS before 2.2.2 allows remote attackers     to cause a denial of service (memory corruption) or     possibly have unspecified other impact via unknown     vectors, a different vulnerability than CVE-2016-4607,     CVE-2016-4608, CVE-2016-4610, and     CVE-2016-4612.(CVE-2016-4609)libxslt in Apple iOS     before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2     on Windows, iCloud before 5.2.1 on Windows, tvOS before     9.2.2, and watchOS before 2.2.2 allows remote attackers     to cause a denial of service (memory corruption) or     possibly have unspecified other impact via unknown     vectors, a different vulnerability than CVE-2016-4607,     CVE-2016-4608, CVE-2016-4609, and     CVE-2016-4612.(CVE-2016-4610)** REJECT ** DO NOT USE     THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-1683.
    Reason: This candidate is a reservation duplicate of     CVE-2016-1683. Notes: All CVE users should reference     CVE-2016-1683 instead of this candidate. All references     and descriptions in this candidate have been removed to     prevent accidental usage.(CVE-2016-4612)In numbers.c in     libxslt 1.1.33, an xsl:number with certain format     strings could lead to a uninitialized read in     xsltNumberFormatInsertNumbers. This could allow an     attacker to discern whether a byte on the stack     contains the characters A, a, I, i, or 0, or any other     character.(CVE-2019-13117)In numbers.c in libxslt     1.1.33, a type holding grouping characters of an     xsl:number instruction was too narrow and an invalid     character/length combination could be passed to     xsltNumberFormatDecimal, leading to a read of     uninitialized stack data.(CVE-2019-13118)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fixes for CVE-2019-13117, CVE-2019-13118

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4164-1 advisory.

    It was discovered that Libxslt incorrectly handled certain documents. An attacker could possibly use this     issue to access sensitive information. This issue not affected Ubuntu 19.10. (CVE-2019-13117,     CVE-2019-13118)

    It was discovered that Libxslt incorrectly handled certain documents. An attacker could possibly use this     issue to execute arbitrary code. (CVE-2019-18197)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libxslt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In numbers.c in libxslt 1.1.33, an xsl:number with     certain format strings could lead to a uninitialized     read in xsltNumberFormatInsertNumbers. This could allow     an attacker to discern whether a byte on the stack     contains the characters A, a, I, i, or 0, or any other     character.(CVE-2019-13117)

  - In numbers.c in libxslt 1.1.33, a type holding grouping     characters of an xsl:number instruction was too narrow     and an invalid character/length combination could be     passed to xsltNumberFormatDecimal, leading to a read of     uninitialized stack data.(CVE-2019-13118)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libxslt packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In numbers.c in libxslt 1.1.33, a type holding grouping     characters of an xsl:number instruction was too narrow     and an invalid character/length combination could be     passed to xsltNumberFormatDecimal, leading to a read of     uninitialized stack data.(CVE-2019-13118)

  - In numbers.c in libxslt 1.1.33, an xsl:number with     certain format strings could lead to a uninitialized     read in xsltNumberFormatInsertNumbers. This could allow     an attacker to discern whether a byte on the stack     contains the characters A, a, I, i, or 0, or any other     character.(CVE-2019-13117)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the libxslt package has been released.

Several vulnerabilities were found in libxslt the XSLT 1.0 processing library.

CVE-2016-4610

Invalid memory access leading to DoS at exsltDynMapFunction. libxslt allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

CVE-2016-4609

Out-of-bounds read at xmlGetLineNoInternal() libxslt allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

CVE-2019-13117

An xsl:number with certain format strings could lead to an uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.

CVE-2019-13118

A type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.

For Debian 8 'Jessie', these problems have been fixed in version 1.1.28-2+deb8u5.

We recommend that you upgrade your libxslt packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libxslt fixes the following issues :

Security issues fixed :

CVE-2019-13118: Fixed a read of uninitialized stack data (bsc#1140101).

CVE-2019-13117: Fixed a uninitialized read which allowed to discern whether a byte on the stack contains certain special characters (bsc#1140095).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
260346	Linux Distros Unpatched Vulnerability : CVE-2019-13117	Nessus	Misc.	medium
242588	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.0.1)	Nessus	Misc.	critical
233563	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.8.1.7)	Nessus	Misc.	critical
215141	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.10.1)	Nessus	Misc.	critical
214211	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.0.0.5)	Nessus	Misc.	critical
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	critical
159402	Amazon Corretto Java 8.x < 8.242.07.1 Multiple Vulnerabilities	Nessus	Misc.	high
137539	SUSE SLED15 / SLES15 Security Update : libxslt (SUSE-SU-2020:1409-1)	Nessus	SuSE Local Security Checks	high
136963	openSUSE Security Update : libxslt (openSUSE-2020-731)	Nessus	SuSE Local Security Checks	high
135571	EulerOS Virtualization 3.0.2.2 : libxslt (EulerOS-SA-2020-1442)	Nessus	Huawei Local Security Checks	high
133096	Amazon Linux 2 : java-11-amazon-corretto (ALAS-2020-1387)	Nessus	Amazon Linux Local Security Checks	high
132992	Oracle Java SE 1.7.0_251 / 1.8.0_241 / 1.11.0_6 / 1.13.0_2 Multiple Vulnerabilities (Jan 2020 CPU)	Nessus	Windows	high
132960	Oracle Java SE 1.7.0_251 / 1.8.0_241 / 1.11.0_6 / 1.13.0_2 Multiple Vulnerabilities (Jan 2020 CPU) (Unix)	Nessus	Misc.	high
132610	EulerOS 2.0 SP8 : libxslt (EulerOS-SA-2020-1017)	Nessus	Huawei Local Security Checks	medium
131672	EulerOS 2.0 SP2 : libxslt (EulerOS-SA-2019-2519)	Nessus	Huawei Local Security Checks	critical
130353	Fedora 31 : libxslt (2019-fdf6ec39b4)	Nessus	Fedora Local Security Checks	medium
130167	Ubuntu 16.04 LTS / 18.04 LTS : Libxslt vulnerabilities (USN-4164-1)	Nessus	Ubuntu Local Security Checks	high
129225	EulerOS 2.0 SP3 : libxslt (EulerOS-SA-2019-2032)	Nessus	Huawei Local Security Checks	medium
128932	EulerOS Virtualization for ARM 64 3.0.2.0 : libxslt (EulerOS-SA-2019-1929)	Nessus	Huawei Local Security Checks	medium
128836	EulerOS 2.0 SP5 : libxslt (EulerOS-SA-2019-1913)	Nessus	Huawei Local Security Checks	medium
128719	Photon OS 2.0: Libxslt PHSA-2019-2.0-0171	Nessus	PhotonOS Local Security Checks	medium
128170	Photon OS 1.0: Libxslt PHSA-2019-1.0-0246	Nessus	PhotonOS Local Security Checks	medium
128155	Photon OS 3.0: Libxslt PHSA-2019-3.0-0024	Nessus	PhotonOS Local Security Checks	medium
126926	Debian DLA-1860-1 : libxslt security update	Nessus	Debian Local Security Checks	critical
126809	SUSE SLED12 / SLES12 Security Update : libxslt (SUSE-SU-2019:1867-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2019-13117

medium

Tenable Plugins

medium

critical

critical

critical

critical

critical

high

high

high

high

high

high

high

medium

critical

medium

high

medium

medium

medium

medium

medium

medium

critical

medium