The remote NewStart CGSL host, running version MAIN 6.02, has libxml2 packages installed that are affected by multiple vulnerabilities:

  - xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file     situation. (CVE-2020-7595)

  - xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to     newDoc->oldNs. (CVE-2019-19956)

  - xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
    (CVE-2019-20388)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libxml2 fixes the following issues :

CVE-2019-20388: Fixed a memory leak in xmlSchemaPreRun (bsc#1161521).

CVE-2019-19956: Fixed a memory leak (bsc#1159928).

CVE-2020-7595: Fixed an infinite loop in an EOF situation (bsc#1161517).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libxml2 fixes the following issues :

  - CVE-2019-20388: Fixed a memory leak in xmlSchemaPreRun     (bsc#1161521).

  - CVE-2019-19956: Fixed a memory leak (bsc#1159928).

  - CVE-2020-7595: Fixed an infinite loop in an EOF     situation (bsc#1161517).

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3996 advisory.

    The libxml2 library is a development toolbox providing the implementation of various XML standards.

    Security Fix(es):

    * libxml2: memory leak in xmlParseBalancedChunkMemoryRecover in parser.c (CVE-2019-19956)

    * libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c (CVE-2019-20388)

    * libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations (CVE-2020-7595)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1534 advisory.

    xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to     newDoc->oldNs. (CVE-2019-19956)

    A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this     library may be vulnerable to memory not being freed leading to a denial of service. System availability is     the highest threat from this vulnerability. (CVE-2019-20388)

    xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file     situation. (CVE-2020-7595)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

ID	Name	Product	Family	Published	Updated	Severity
147266	NewStart CGSL MAIN 6.02 : libxml2 Multiple Vulnerabilities (NS-SA-2021-0061)	Nessus	NewStart CGSL Local Security Checks	3/10/2021	3/10/2021	high
136792	SUSE SLED15 / SLES15 Security Update : libxml2 (SUSE-SU-2020:1299-1)	Nessus	SuSE Local Security Checks	5/22/2020	3/12/2024	high
136879	openSUSE Security Update : libxml2 (openSUSE-2020-681)	Nessus	SuSE Local Security Checks	5/26/2020	3/8/2024	high
141039	RHEL 7 : libxml2 (RHSA-2020:3996)	Nessus	Red Hat Local Security Checks	9/29/2020	11/7/2024	high
141978	Amazon Linux 2 : libxml2 (ALAS-2020-1534)	Nessus	Amazon Linux Local Security Checks	10/28/2020	12/11/2024	high
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	6/30/2023	7/6/2023	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

critical