It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-058 advisory.

    In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in     xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
    (CVE-2021-45960)

    In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for     m_groupSize. (CVE-2021-46143)

    addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22822)

    build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22823)

    defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
    (CVE-2022-22824)

    lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22825)

    nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
    (CVE-2022-22826)

    storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22827)

    expat (libexpat) is susceptible to a software flaw that causes process interruption. When processing a     large number of prefixed XML attributes on a single tag can libexpat can terminate unexpectedly due to     integer overflow. The highest threat from this vulnerability is to availability, confidentiality and     integrity. (CVE-2022-23852)

    Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. (CVE-2022-23990)

    A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences (for example, from start tag     names) to the XML processing application on top of expat can lead to arbitrary code execution. This issue     is dependent on how invalid UTF-8 is handled inside the XML processor. (CVE-2022-25235)

    A flaw was found in expat. Passing one or more namespace separator characters in the xmlns[:prefix]     attribute values made expat send malformed tag names to the XML processor on top of expat. This issue     causes arbitrary code execution depending on how unexpected cases are handled inside the XML processor.
    (CVE-2022-25236)

    A flaw was found in expat. A stack exhaustion in doctype parsing could be triggered by a file with a large     number of opening braces, resulting in a denial of service. (CVE-2022-25313)

    An integer overflow flaw was found in expat. This issue affects the encoding name parameter at the parser     creation time, which is often hard-coded (rather than user input), takes a value in the gigabytes to     trigger, and on a 64-bit machine. This flaw can cause a denial of service. (CVE-2022-25314)

    An integer overflow was found in expat. The issue occurs in storeRawNames() by abusing the m_buffer     expansion logic to allow allocations very close to INT_MAX and out-of-bounds heap writes. This flaw can     cause a denial of service or potentially arbitrary code execution. (CVE-2022-25315)

    A vulnerability was found in expat. With this flaw, it is possible to create a situation in which parsing     is suspended while substituting in an internal entity so that XML_ResumeParser directly uses the     internalEntityProcessor as its processor. If the subsequent parse includes some unclosed tags, this will     return without calling storeRawNames to ensure that the raw versions of the tag names are stored in memory     other than the parse buffer itself. Issues occur if the parse buffer is changed or reallocated (for     example, if processing a file line by line), problems occur. Using this vulnerability in the doContent     function allows an attacker to triage a denial of service or potentially arbitrary code execution.
    (CVE-2022-40674)

    In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in     XML_ExternalEntityParserCreate in out-of-memory situations. (CVE-2022-43680)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5455-1 advisory.

    Tim Boddy, Gustavo Grieco and others discovered that Expat, that is integrated in xmltok library,     incorrectly handled certain files. An attacker could possibly use these issues to cause a denial of     service, or possibly execute arbitrary code. These issues were only addressed in Ubuntu 16.04 ESM.
    (CVE-2012-1148, CVE-2015-1283, CVE-2016-0718, CVE-2016-4472, CVE-2018-20843, CVE-2019-15903,     CVE-2021-46143, CVE-2022-22822, CVE-2022-22823, CVE-2022-22824, CVE-2022-22825, CVE-2022-22826,     CVE-2022-22827)

    It was discovered that Expat, that is integrated in xmltok library, incorrectly handled encoding     validation of certain files. An attacker could possibly use this issue to cause a denial of service, or     possibly execute arbitrary code. (CVE-2022-25235)

    It was discovered that Expat, that is integrated in xmltok library, incorrectly handled namespace URIs of     certain files. An attacker could possibly use this issue to cause a denial of service, or possibly execute     arbitrary code. (CVE-2022-25236)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20220304.10013. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20220304.10013 advisory.

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. (CVE-2022-25315)

  - In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in     xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
    (CVE-2021-45960)

  - An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the     attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content     to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing     filenames with two or more newlines where selected content and the target file names are embedded in     crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write     arbitrary files on the system. (CVE-2022-1271)

  - http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5     allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR     and LF control characters in the first argument of HTTPConnection.request. (CVE-2020-26116)

  - urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as     demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this     is similar to CVE-2020-26116. (CVE-2020-26137)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2022:0035 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2022-25235:
    xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks     for whether a UTF-8 character is valid in a certain context.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0021 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2021-45960:
    In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in     xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).

    CVE-2021-46143:
    In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for     m_groupSize.

    CVE-2022-22822:
    addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    CVE-2022-22823:
    build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    CVE-2022-22824:
    defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    CVE-2022-22825:
    lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    CVE-2022-22826:
    nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    CVE-2022-22827:
    storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    CVE-2022-23852:
    Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with     a nonzero XML_CONTEXT_BYTES.

    CVE-2022-25235:
    xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks     for whether a UTF-8 character is valid in a certain context.

    CVE-2022-25236:
    xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters     into namespace URIs.

    CVE-2022-25315:
    In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20201105.2286. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20201105.2286 advisory.

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. (CVE-2022-25315)

  - In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in     xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
    (CVE-2021-45960)

  - A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed     by OpenLDAP's slapd server, to trigger an assertion failure. The highest threat from this vulnerability is     to system availability. (CVE-2020-25709)

  - A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious     packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this     vulnerability is to system availability. (CVE-2020-25710)

  - In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL     INSERT or UPDATE statement. (CVE-2022-24407)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:1263 advisory.

    The redhat-virtualization-host packages provide the Red Hat Virtualization Host.
    These packages include redhat-release-virtualization-host. Red Hat     Virtualization Hosts (RHVH) are installed using a special build of Red Hat     Enterprise Linux with only the packages required to host virtual machines.
    RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative     tasks.

    Security Fix(es):

    * kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)

    * kernel: use-after-free in RDMA listen() (CVE-2021-4028)

    * kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)

    * kernel: xfs: raw block device data leak in XFS_IOC_ALLOCSP IOCTL (CVE-2021-4155)

    * aide: heap-based buffer overflow on outputs larger than B64_BUF (CVE-2021-45417)

    * kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)

    * openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates (CVE-2022-0778)

    * kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)

    * cyrus-sasl: failure to properly escape SQL input allows an attacker to execute arbitrary SQL commands     (CVE-2022-24407)

    * expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)

    * expat: Namespace-separator characters in xmlns[:prefix] attribute values can lead to arbitrary code     execution (CVE-2022-25236)

    * expat: Integer overflow in storeRawNames() (CVE-2022-25315)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RHV-H has been rebased on RHEL-7.9.z #13 (BZ#2048409)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.1.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.1.1 advisory.

  - JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write     access to the Log4j configuration. The attacker can provide TopicBindingName and     TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result     in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2     when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of     life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the     previous versions. (CVE-2021-4104)

  - It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-     default configurations. This could allows attackers with control over Thread Context Map (MDC) input data     when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for     example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input     data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some     environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix     this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
    (CVE-2021-45046)

  - Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI     features used in configuration, log messages, and parameters do not protect against attacker controlled     LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters     can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From     log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3,     and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to     log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
    (CVE-2021-44228)

  - xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and     watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows     remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory     corruption) via a crafted XML document. (CVE-2016-4658)

  - NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow     when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures     encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for     certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how     they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and     PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and     Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.
    (CVE-2021-43527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	Name	Product	Family	Published	Updated	Severity
173105	Amazon Linux 2023 : expat, expat-devel, expat-static (ALAS2023-2023-058)	Nessus	Amazon Linux Local Security Checks	3/21/2023	12/11/2024	critical
183151	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : xmltok library vulnerabilities (USN-5455-1)	Nessus	Ubuntu Local Security Checks	10/16/2023	8/28/2024	critical
170654	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20220304.10013)	Nessus	Misc.	1/25/2023	2/17/2025	critical
239369	TencentOS Server 3: xmlrpc-c (TSSA-2022:0035)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	critical
239166	TencentOS Server 3: expat (TSSA-2022:0021)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	critical
164565	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20201105.2286)	Nessus	Misc.	9/1/2022	2/17/2025	critical
159595	RHEL 7 : RHV-H security update (redhat-virtualization-host) 4.3.22 (Important) (RHSA-2022:1263)	Nessus	Red Hat Local Security Checks	4/7/2022	11/7/2024	critical
164572	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.1.1)	Nessus	Misc.	9/1/2022	2/17/2025	high
503982	Siemens SIMATIC S7-1500 Improper Encoding or Escaping of Output (CVE-2022-25235)	Tenable OT Security	Tenable.ot	11/13/2025	11/13/2025	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

high

critical