A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all."

The remote openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4115-1 advisory.

    - CVE-2025-9714: Fixed inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c     (bsc#1249076)
    - CVE-2025-8732: Fixed infinite recursion in catalog parsing functions when processing malformed SGML     catalog files (bsc#1247850)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4104-1 advisory.

    - CVE-2025-9714: Fixed infinite recursion at exsltDynMapFunction function in libexslt/dynamic.c     (bsc#1249076)
    - CVE-2025-8732: Fixed infinite recursion in catalog parsing functions when processing malformed SGML     catalog files (bsc#1247850)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability     affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to     uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public     and may be used. The real existence of this vulnerability is still doubted at the moment. The code     maintainer explains, that [t]he issue can only be triggered with untrusted SGML catalogs and it makes     absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at     all. (CVE-2025-8732)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
275597	openSUSE 15 Security Update : libxml2 (SUSE-SU-2025:4115-1)	Nessus	SuSE Local Security Checks	medium
275505	SUSE SLES12 Security Update : libxml2 (SUSE-SU-2025:4104-1)	Nessus	SuSE Local Security Checks	medium
253547	Linux Distros Unpatched Vulnerability : CVE-2025-8732	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-8732

medium

Tenable Plugins

medium

medium

medium