The ezxml_toxml function in ezxml 0.8.6 and earlier is vulnerable to OOB write when opening XML file after exhausting the memory pool.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The ezxml_toxml function in ezxml 0.8.6 and earlier is vulnerable to OOB write when opening XML file after     exhausting the memory pool. (CVE-2021-26220)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3804-1 advisory.

    - Fixed multiple vulnerabilities in ezXML:
        CVE-2019-20007, CVE-2019-20006, CVE-2019-20201, CVE-2019-20202,         CVE-2019-20199, CVE-2019-20200, CVE-2019-20198, CVE-2021-26221,         CVE-2021-26222, CVE-2021-30485, CVE-2021-31229, CVE-2021-31347,         CVE-2021-31348, CVE-2021-31598 (bsc#1191856)        Note:
       * CVE-2021-26220 https://sourceforge.net/p/ezxml/bugs/23          not relevant for netcdf: code isn't used.
       * CVE-2019-20005 https://sourceforge.net/p/ezxml/bugs/14          Issue cannot be reproduced and no patch is available upstream.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3805-1 advisory.

    - Fixed multiple vulnerabilities in ezXML:
        CVE-2019-20007, CVE-2019-20006, CVE-2019-20201, CVE-2019-20202,         CVE-2019-20199, CVE-2019-20200, CVE-2019-20198, CVE-2021-26221,         CVE-2021-26222, CVE-2021-30485, CVE-2021-31229, CVE-2021-31347,         CVE-2021-31348, CVE-2021-31598 (bsc#1191856)        Note:
       * CVE-2021-26220 https://sourceforge.net/p/ezxml/bugs/23          not relevant for netcdf: code isn't used.
       * CVE-2019-20005 https://sourceforge.net/p/ezxml/bugs/14          Issue cannot be reproduced and no patch is available upstream.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3873-1 advisory.

    - Fixed multiple vulnerabilities in ezXML:
        CVE-2019-20007, CVE-2019-20006, CVE-2019-20201, CVE-2019-20202,         CVE-2019-20199, CVE-2019-20200, CVE-2019-20198, CVE-2021-26221,         CVE-2021-26222, CVE-2021-30485, CVE-2021-31229, CVE-2021-31347,         CVE-2021-31348, CVE-2021-31598 (bsc#1191856)        Note:
       * CVE-2021-26220 https://sourceforge.net/p/ezxml/bugs/23          not relevant for netcdf: code isn't used.
       * CVE-2019-20005 https://sourceforge.net/p/ezxml/bugs/14          Issue cannot be reproduced and no patch is available upstream.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3873-1 advisory.

  - An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing a crafted     XML file, performs incorrect memory handling, leading to a heap-based buffer over-read while running     strchr() starting with a pointer after a '\0' character (where the processing of a string was finished).
    (CVE-2019-20005)

  - An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_char_content puts a pointer to     the internal address of a larger block as xml->txt. This is later deallocated (using free), leading to a     segmentation fault. (CVE-2019-20006)

  - An issue was discovered in ezXML 0.8.2 through 0.8.6. The function ezxml_str2utf8, while parsing a crafted     XML file, performs zero-length reallocation in ezxml.c, leading to returning a NULL pointer (in some     compilers). After this, the function ezxml_parse_str does not check whether the s variable is not NULL in     ezxml.c, leading to a NULL pointer dereference and crash (segmentation fault). (CVE-2019-20007)

  - An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_ent_ok() mishandles recursion,     leading to stack consumption for a crafted XML file. (CVE-2019-20198)

  - An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing a crafted     XML file, performs incorrect memory handling, leading to NULL pointer dereference while running strlen()     on a NULL pointer. (CVE-2019-20199)

  - An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing crafted a     XML file, performs incorrect memory handling, leading to a heap-based buffer over-read in the normalize     line endings feature. (CVE-2019-20200)

  - An issue was discovered in ezXML 0.8.3 through 0.8.6. The ezxml_parse_* functions mishandle XML entities,     leading to an infinite loop in which memory allocations occur. (CVE-2019-20201)

  - An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_char_content() tries to use     realloc on a block that was not allocated, leading to an invalid free and segmentation fault.
    (CVE-2019-20202)

  - The ezxml_toxml function in ezxml 0.8.6 and earlier is vulnerable to OOB write when opening XML file after     exhausting the memory pool. (CVE-2021-26220)

  - The ezxml_new function in ezXML 0.8.6 and earlier is vulnerable to OOB write when opening XML file after     exhausting the memory pool. (CVE-2021-26221, CVE-2021-26222)

  - An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd(), while parsing a     crafted XML file, performs incorrect memory handling, leading to a NULL pointer dereference while running     strcmp() on a NULL pointer. (CVE-2021-30485)

  - An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd() performs incorrect     memory handling while parsing crafted XML files, which leads to an out-of-bounds write of a one byte     constant. (CVE-2021-31229)

  - An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs incorrect     memory handling while parsing crafted XML files (writing outside a memory region created by mmap).
    (CVE-2021-31347)

  - An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs incorrect     memory handling while parsing crafted XML files (out-of-bounds read after a certain strcspn failure).
    (CVE-2021-31348)

  - An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_decode() performs incorrect     memory handling while parsing crafted XML files, leading to a heap-based buffer overflow. (CVE-2021-31598)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3815-1 advisory.

    - Fixed multiple vulnerabilities in ezXML:
        CVE-2019-20007, CVE-2019-20006, CVE-2019-20201, CVE-2019-20202,         CVE-2019-20199, CVE-2019-20200, CVE-2019-20198, CVE-2021-26221,         CVE-2021-26222, CVE-2021-30485, CVE-2021-31229, CVE-2021-31347,         CVE-2021-31348, CVE-2021-31598 (bsc#1191856)        Note:
       * CVE-2021-26220 https://sourceforge.net/p/ezxml/bugs/23          not relevant for netcdf: code isn't used.
       * CVE-2019-20005 https://sourceforge.net/p/ezxml/bugs/14          Issue cannot be reproduced and no patch is available upstream.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3815-1 advisory.

  - An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing a crafted     XML file, performs incorrect memory handling, leading to a heap-based buffer over-read while running     strchr() starting with a pointer after a '\0' character (where the processing of a string was finished).
    (CVE-2019-20005)

  - An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_char_content puts a pointer to     the internal address of a larger block as xml->txt. This is later deallocated (using free), leading to a     segmentation fault. (CVE-2019-20006)

  - An issue was discovered in ezXML 0.8.2 through 0.8.6. The function ezxml_str2utf8, while parsing a crafted     XML file, performs zero-length reallocation in ezxml.c, leading to returning a NULL pointer (in some     compilers). After this, the function ezxml_parse_str does not check whether the s variable is not NULL in     ezxml.c, leading to a NULL pointer dereference and crash (segmentation fault). (CVE-2019-20007)

  - An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_ent_ok() mishandles recursion,     leading to stack consumption for a crafted XML file. (CVE-2019-20198)

  - An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing a crafted     XML file, performs incorrect memory handling, leading to NULL pointer dereference while running strlen()     on a NULL pointer. (CVE-2019-20199)

  - An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing crafted a     XML file, performs incorrect memory handling, leading to a heap-based buffer over-read in the normalize     line endings feature. (CVE-2019-20200)

  - An issue was discovered in ezXML 0.8.3 through 0.8.6. The ezxml_parse_* functions mishandle XML entities,     leading to an infinite loop in which memory allocations occur. (CVE-2019-20201)

  - An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_char_content() tries to use     realloc on a block that was not allocated, leading to an invalid free and segmentation fault.
    (CVE-2019-20202)

  - The ezxml_toxml function in ezxml 0.8.6 and earlier is vulnerable to OOB write when opening XML file after     exhausting the memory pool. (CVE-2021-26220)

  - The ezxml_new function in ezXML 0.8.6 and earlier is vulnerable to OOB write when opening XML file after     exhausting the memory pool. (CVE-2021-26221, CVE-2021-26222)

  - An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd(), while parsing a     crafted XML file, performs incorrect memory handling, leading to a NULL pointer dereference while running     strcmp() on a NULL pointer. (CVE-2021-30485)

  - An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd() performs incorrect     memory handling while parsing crafted XML files, which leads to an out-of-bounds write of a one byte     constant. (CVE-2021-31229)

  - An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs incorrect     memory handling while parsing crafted XML files (writing outside a memory region created by mmap).
    (CVE-2021-31347)

  - An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs incorrect     memory handling while parsing crafted XML files (out-of-bounds read after a certain strcspn failure).
    (CVE-2021-31348)

  - An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_decode() performs incorrect     memory handling while parsing crafted XML files, leading to a heap-based buffer overflow. (CVE-2021-31598)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1505-1 advisory.

  - An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing a crafted     XML file, performs incorrect memory handling, leading to a heap-based buffer over-read while running     strchr() starting with a pointer after a '\0' character (where the processing of a string was finished).
    (CVE-2019-20005)

  - An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_char_content puts a pointer to     the internal address of a larger block as xml->txt. This is later deallocated (using free), leading to a     segmentation fault. (CVE-2019-20006)

  - An issue was discovered in ezXML 0.8.2 through 0.8.6. The function ezxml_str2utf8, while parsing a crafted     XML file, performs zero-length reallocation in ezxml.c, leading to returning a NULL pointer (in some     compilers). After this, the function ezxml_parse_str does not check whether the s variable is not NULL in     ezxml.c, leading to a NULL pointer dereference and crash (segmentation fault). (CVE-2019-20007)

  - An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_ent_ok() mishandles recursion,     leading to stack consumption for a crafted XML file. (CVE-2019-20198)

  - An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing a crafted     XML file, performs incorrect memory handling, leading to NULL pointer dereference while running strlen()     on a NULL pointer. (CVE-2019-20199)

  - An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing crafted a     XML file, performs incorrect memory handling, leading to a heap-based buffer over-read in the normalize     line endings feature. (CVE-2019-20200)

  - An issue was discovered in ezXML 0.8.3 through 0.8.6. The ezxml_parse_* functions mishandle XML entities,     leading to an infinite loop in which memory allocations occur. (CVE-2019-20201)

  - An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_char_content() tries to use     realloc on a block that was not allocated, leading to an invalid free and segmentation fault.
    (CVE-2019-20202)

  - The ezxml_toxml function in ezxml 0.8.6 and earlier is vulnerable to OOB write when opening XML file after     exhausting the memory pool. (CVE-2021-26220)

  - The ezxml_new function in ezXML 0.8.6 and earlier is vulnerable to OOB write when opening XML file after     exhausting the memory pool. (CVE-2021-26221, CVE-2021-26222)

  - An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd(), while parsing a     crafted XML file, performs incorrect memory handling, leading to a NULL pointer dereference while running     strcmp() on a NULL pointer. (CVE-2021-30485)

  - An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd() performs incorrect     memory handling while parsing crafted XML files, which leads to an out-of-bounds write of a one byte     constant. (CVE-2021-31229)

  - An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs incorrect     memory handling while parsing crafted XML files (writing outside a memory region created by mmap).
    (CVE-2021-31347)

  - An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs incorrect     memory handling while parsing crafted XML files (out-of-bounds read after a certain strcspn failure).
    (CVE-2021-31348)

  - An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_decode() performs incorrect     memory handling while parsing crafted XML files, leading to a heap-based buffer overflow. (CVE-2021-31598)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
223710	Linux Distros Unpatched Vulnerability : CVE-2021-26220	Nessus	Misc.	high
178279	SUSE SLES15: libnetcdf-gnu-hpc / libnetcdf-gnu-mpich-hpc / etc (SUSE-SU-2021:3804-1)	Nessus	SuSE Local Security Checks	high
178276	SUSE SLES15: libnetcdf-gnu-hpc / libnetcdf-gnu-mpich-hpc / etc (SUSE-SU-2021:3805-1)	Nessus	SuSE Local Security Checks	high
155836	SUSE SLES15: libnetcdf-gnu-hpc / libnetcdf-gnu-mpich-hpc / etc (SUSE-SU-2021:3873-1)	Nessus	SuSE Local Security Checks	high
155826	openSUSE 15 Security Update : netcdf (openSUSE-SU-2021:3873-1)	Nessus	SuSE Local Security Checks	high
155748	SUSE SLES15: libnetcdf-gnu-hpc / libnetcdf-gnu-mpich-hpc / etc (SUSE-SU-2021:3815-1)	Nessus	SuSE Local Security Checks	high
155744	openSUSE 15 Security Update : netcdf (openSUSE-SU-2021:3815-1)	Nessus	SuSE Local Security Checks	high
155714	openSUSE 15 Security Update : netcdf (openSUSE-SU-2021:1505-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2021-26220

high

Tenable Plugins

high

high

high

high

high

high

high

high