FreeBSD : libxml2 -- multiple vulnerabilities (e195679d-045b-4953-bb33-be0073ba2ac6)

This script is Copyright (C) 2016-2017 Tenable Network Security, Inc.


Synopsis :

The remote FreeBSD host is missing a security-related update.

Description :

Daniel Veillard reports :

More format string warnings with possible format string vulnerability
(David Kilzer)

Avoid building recursive entities (Daniel Veillard)

Heap-based buffer overread in htmlCurrentChar (Pranjal Jumde)

Heap-based buffer-underreads due to xmlParseName (David Kilzer)

Heap use-after-free in xmlSAX2AttributeNs (Pranjal Jumde)

Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral
(Pranjal Jumde)

Fix some format string warnings with possible format string
vulnerability (David Kilzer)

Detect change of encoding when parsing HTML names (Hugh Davenport)

Fix inappropriate fetch of entities content (Daniel Veillard)

Bug 759398: Heap use-after-free in xmlDictComputeFastKey (Pranjal
Jumde)

Bug 758605: Heap-based buffer overread in xmlDictAddString (Pranjal
Jumde)

Bug 758588: Heap-based buffer overread in
xmlParserPrintFileContextInternal (David Kilzer)

Bug 757711: heap-buffer-overflow in xmlFAParsePosCharGroup (Pranjal
Jumde)

Add missing increments of recursion depth counter to XML parser.
(Peter Simons)

Fix NULL pointer deref in XPointer range-to

See also :

https://mail.gnome.org/archives/xml/2016-May/msg00023.html
https://bugzilla.gnome.org/show_bug.cgi?id=759398
https://bugzilla.gnome.org/show_bug.cgi?id=758605
https://bugzilla.gnome.org/show_bug.cgi?id=758588
https://bugzilla.gnome.org/show_bug.cgi?id=757711
http://www.nessus.org/u?96b5bf04
http://www.nessus.org/u?6e0c0388

Solution :

Update the affected package.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now