The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5250 advisory.

    The libxml2 library is a development toolbox providing the implementation of various XML standards.

    Security Fix(es):

    * libxml2: integer overflows in xmlBuf and xmlBuffer lead to out-of-bounds write (CVE-2022-29824)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-5250 advisory.

    [2.9.13-1.1]
    - Fix CVE-2022-29824 (#2082299)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29824 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29824 GNOME libxml2 is vulnerable to a denial of service, caused by an integer overflows in several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*). By persuading a victim to open a specially-crafted XML file, a remote attacker could exploit this vulnerability to cause a denial of service condition.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-198 advisory.

    valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. (CVE-2022-23308)

    A flaw was found in the libxml2 library in functions used to manipulate the xmlBuf and the xmlBuffer     types. A substantial input causes values to calculate buffer sizes to overflow, resulting in an out-of-     bounds write. (CVE-2022-29824)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 10.5.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-20 advisory.

  - Nessus leverages third-party software to help provide underlying functionality. Several of the third-party     components (libxml2, libxslt) were found to contain vulnerabilities, and updated versions have been made     available by the provider.    Out of caution and in line with best practice, Tenable has opted to upgrade     these components to address the potential impact of the issues. Nessus 10.5.2 updates libxml2 to version     2.11.1 and libxslt to version 1.1.37 to address the identified vulnerabilities. Tenable has released     Nessus 10.5.2 to address these issues. The installation files can be obtained from the Tenable Downloads     Portal (https://www.tenable.com/downloads/nessus). (CVE-2022-29824, CVE-2023-28484, CVE-2023-29469)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:5250 advisory.

  - In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*)     don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a     victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for     example libxslt through 1.1.35, is affected as well. (CVE-2022-29824)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2022:0127 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2022-29824:
    In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*)     don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a     victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for     example libxslt through 1.1.35, is affected as well.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3668:04 advisory.

    * libxml2: integer overflows in xmlBuf and xmlBuffer lead to out-of-bounds     write (CVE-2022-29824)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Nessus application running on the remote host is 10.x prior to 10.3.1. It is, therefore, affected by multiple vulnerabilities, including:

  - A use-after-free vulnerability in the doContent function in xmlparse.c in libexpat. (CVE-2022-40674)

  - A path traversal vulnerability in the locale string handling functionality of Moment.js. (CVE-2022-24785)

  - A denial of service vulnerability in the string-to-date parsing functinality in Moment.js (CVE-2022-31129)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

ID	Name	Product	Family	Published	Updated	Severity
162658	RHEL 9 : libxml2 (RHSA-2022:5250)	Nessus	Red Hat Local Security Checks	7/1/2022	11/7/2024	medium
162794	Oracle Linux 9 : libxml2 (ELSA-2022-5250)	Nessus	Oracle Linux Local Security Checks	7/7/2022	11/2/2024	medium
165285	AIX 7.3 TL 0 : libxml2 (IJ42341)	Nessus	AIX Local Security Checks	9/21/2022	6/5/2023	medium
167021	Amazon Linux 2022 : libxml2, libxml2-devel, libxml2-static (ALAS2022-2022-198)	Nessus	Amazon Linux Local Security Checks	11/5/2022	12/11/2024	high
175427	Tenable Nessus < 10.5.2 Multiple Vulnerabilities (TNS-2023-20)	Nessus	Misc.	5/12/2023	6/13/2024	medium
184834	Rocky Linux 9 : libxml2 (RLSA-2022:5250)	Nessus	Rocky Linux Local Security Checks	11/7/2023	11/7/2023	medium
239518	TencentOS Server 3: libxml2 (TSSA-2022:0127)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	medium
293503	MiracleLinux 8 : libxml2-2.9.7-13.el8.1 (AXSA:2022-3668:04)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	medium
166600	Tenable Nessus 10.x < 10.3.1 Multiple Vulnerabilities (TNS-2022-20)	Nessus	Misc.	10/27/2022	2/16/2024	critical
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	6/30/2023	7/6/2023	critical

Detections

Analytics

Plugins Search

medium

medium

medium

high

medium

medium

medium

medium

critical

critical