The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2972 advisory.

    Five security issues have been discovered in libxml2: XML C parser and toolkit. CVE-2016-9318 Vulnerable     versions do not offer a flag directly indicating that the current document may be read but other files may     not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via     a crafted document. CVE-2017-5130 Integer overflow in memory debug code, allowed a remote attacker to     potentially exploit heap corruption via a crafted XML file. CVE-2017-5969 Parser in a recover mode allows     remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document.
    CVE-2017-16932 When expanding a parameter entity in a DTD, infinite recursion could lead to an infinite     loop or memory exhaustion. CVE-2022-23308 the application that validates XML using xmlTextReaderRead()     with XML_PARSE_DTDATTR and XML_PARSE_DTDVALID enabled becomes vulnerable to this use-after-free bug. This     issue can result in denial of service. For Debian 9 stretch, these problems have been fixed in version     2.9.4+dfsg1-2.2+deb9u6. We recommend that you upgrade your libxml2 packages. For the detailed security     status of libxml2 please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/libxml2 Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Nessus application running on the remote host is 10.x prior to 10.3.1. It is, therefore, affected by multiple vulnerabilities, including:

  - A use-after-free vulnerability in the doContent function in xmlparse.c in libexpat. (CVE-2022-40674)

  - A path traversal vulnerability in the locale string handling functionality of Moment.js. (CVE-2022-24785)

  - A denial of service vulnerability in the string-to-date parsing functinality in Moment.js (CVE-2022-31129)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

ID	Name	Product	Family	Published	Updated	Severity
159615	Debian DLA-2972-1 : libxml2 - LTS security update	Nessus	Debian Local Security Checks	4/9/2022	1/24/2025	high
166600	Tenable Nessus 10.x < 10.3.1 Multiple Vulnerabilities (TNS-2022-20)	Nessus	Misc.	10/27/2022	10/30/2026	critical
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	6/30/2023	7/6/2023	critical
161410	macOS 12.x < 12.4 Multiple Vulnerabilities (HT213257)	Nessus	MacOS X Local Security Checks	5/20/2022	8/23/2024	critical

Detections

Analytics

Plugins Search

high

critical

critical

critical