The remote Solaris system is missing necessary patches to address security updates :

  - libxml2 2.9.0 and earlier allows context-dependent     attackers to cause a denial of service (CPU and memory     consumption) via an XML file containing an entity     declaration with long replacement text and many     references to this entity, aka 'internal entity     expansion' with linear complexity. (CVE-2013-0338)

Brad Hill of iSEC Partners discovered that many XML implementations are vulnerable to external entity expansion issues, which can be used for various purposes such as firewall circumvention, disguising an IP address, and denial-of-service. libxml2 was susceptible to these problems when performing string substitution during entity expansion.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party libraries :

  - GnuTLS
  - Kernel
  - OpenSSL

Updated libxml2 packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libxml2 library is a development toolbox providing the implementation of various XML standards.

A denial of service flaw was found in the way libxml2 performed string substitutions when entity values for entity references replacement was enabled. A remote attacker could provide a specially crafted XML file that, when processed by an application linked against libxml2, would lead to excessive CPU consumption. (CVE-2013-0338)

All users of libxml2 are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The desktop must be restarted (log out, then log back in) for this update to take effect.

According to its self-reported version number, the remote Junos device is affected by multiple vulnerabilities in the libxml2 library :

  - A heap-based buffer overflow vulnerability exists which     can result in arbitrary code execution. (CVE-2011-1944)

  - A denial of service vulnerability exists which can     result in excessive CPU consumption. (CVE-2012-0841)

  - A heap-based buffer overflow vulnerability exists in     the 'xmlParseAttValueComplex' function which can result     in arbitrary code execution. (CVE-2012-5134)

  - A denial of service vulnerability exists due to     excessive CPU and memory consumption in the processing     of XML files containing entity declarations with long     replacement text (also known as 'internal entity     expansion with linear complexity'). (CVE-2013-0338)

  - A denial of service vulnerability exists related to the     XML_PARSER_EOF state checking. (CVE-2013-2877)

These vulnerabilities can be exploited by a remote attacker via a specially crafted XML file.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

ID	Name	Product	Family	Published	Updated	Severity
80690	Oracle Solaris Third-Party Patch Update : libxml2 (cve_2013_0338_denial_of)	Nessus	Solaris Local Security Checks	1/19/2015	1/14/2021	medium
65695	Debian DSA-2652-1 : libxml2 - external entity expansion	Nessus	Debian Local Security Checks	3/27/2013	1/11/2021	medium
89666	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2013-0009) (remote check)	Nessus	Misc.	3/4/2016	12/5/2022	medium
64945	RHEL 5 / 6 : libxml2 (RHSA-2013:0581)	Nessus	Red Hat Local Security Checks	3/1/2013	1/14/2021	medium
80957	Juniper Junos libxml2 Library Multiple Vulnerabilities (JSA10669)	Nessus	Junos Local Security Checks	1/23/2015	7/12/2018	high
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	6/30/2023	7/6/2023	critical

Detections

Analytics

Plugins Search

medium

medium

medium

medium

high

critical