Detections
Analytics
Debian dsa-5949 : libxml2 - security update
high Nessus Plugin ID 240559
Synopsis
The remote Debian host is missing one or more security-related updates.Description
The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5949 advisory.- ------------------------------------------------------------------------- Debian Security Advisory DSA-5949-1 [email protected] https://www.debian.org/security/ Aron Xu June 26, 2025 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : libxml2 CVE ID : CVE-2022-49043 CVE-2023-39615 CVE-2023-45322 CVE-2024-25062 CVE-2024-34459 CVE-2024-56171 CVE-2025-24928 CVE-2025-27113 CVE-2025-32414 CVE-2025-32415 Debian Bug : 1051230 1053629 1063234 1071162 1094238 1098320 1098321 1098322 1102521 1103511
Brief introduction
Multiple memory related vulnerabilities, inlcuding use-after-free, out-of-bounds memory access and NULL pointer dereference, were discovered in GNOME XML Parser and Toolkit Library and its Python bindings, which may cause denial of service or other unintended behaviors.
For the stable distribution (bookworm), these problems have been fixed in version 2.9.14+dfsg-1.3~deb12u2.
We recommend that you upgrade your libxml2 packages.
For the detailed security status of libxml2 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/libxml2
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: [email protected]
Tenable has extracted the preceding description block directly from the Debian security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade the libxml2 packages.See Also
https://security-tracker.debian.org/tracker/source-package/libxml2
https://security-tracker.debian.org/tracker/CVE-2022-49043
https://security-tracker.debian.org/tracker/CVE-2023-39615
https://security-tracker.debian.org/tracker/CVE-2023-45322
https://security-tracker.debian.org/tracker/CVE-2024-25062
https://security-tracker.debian.org/tracker/CVE-2024-34459
https://security-tracker.debian.org/tracker/CVE-2024-56171
https://security-tracker.debian.org/tracker/CVE-2025-24928
https://security-tracker.debian.org/tracker/CVE-2025-27113
https://security-tracker.debian.org/tracker/CVE-2025-32414
Plugin Details
Severity: High
ID: 240559
File Name: debian_DSA-5949.nasl
Version: 1.1
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 6/26/2025
Updated: 6/26/2025
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.1
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.1
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2025-32415
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:python3-libxml2, p-cpe:/a:debian:debian_linux:libxml2-utils, p-cpe:/a:debian:debian_linux:libxml2-dev, p-cpe:/a:debian:debian_linux:libxml2, p-cpe:/a:debian:debian_linux:libxml2-doc, cpe:/o:debian:debian_linux:12.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/26/2025
Vulnerability Publication Date: 6/13/2023
Reference Information
CVE: CVE-2022-49043, CVE-2023-39615, CVE-2023-45322, CVE-2024-25062, CVE-2024-34459, CVE-2024-56171, CVE-2025-24928, CVE-2025-27113, CVE-2025-32414, CVE-2025-32415
IAVA: 2024-A-0067-S, 2025-A-0123-S, 2025-A-0229-S, 2025-A-0293