Update to 1.2.29 that's required by LibreOffice 6.4.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-2492 advisory.

    - CVE-2017-1000061
    - CVE-2017-1000061

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - It was discovered xmlsec1's use of libxml2 inadvertently     enabled external entity expansion (XXE) along with     validation. An attacker could craft an XML file that     would cause xmlsec1 to try and read local files or     HTTP/FTP URLs, leading to information disclosure or     denial of service. (CVE-2017-1000061)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5674-1 advisory.

    It was discovered that XML Security Library incorrectly handled certain input documents. An attacker could     possibly use this issue to obtain sensitive information or cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

According to the version of the xmlsec1 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was discovered xmlsec1's use of libxml2     inadvertently enabled external entity expansion (XXE)     along with validation. An attacker could craft an XML     file that would cause xmlsec1 to try and read local     files or HTTP/FTP URLs, leading to information     disclosure or denial of service. (CVE-2017-1000061)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-1915:01 advisory.

    XML Security Library is a C library based on LibXML2  and OpenSSL.
    The library was created with a goal to support major XML security     standards XML Digital Signature and XML Encryption.
    CVE-2017-1000
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2492 advisory.

    XML Security Library is a C library based on LibXML2 and OpenSSL. The library was created with a goal to     support major XML security standards XML Digital Signature and XML Encryption.

    Security Fix(es):

    * It was discovered xmlsec1's use of libxml2 inadvertently enabled external entity expansion (XXE) along     with validation. An attacker could craft an XML file that would cause xmlsec1 to try and read local files     or HTTP/FTP URLs, leading to information disclosure or denial of service. (CVE-2017-1000061)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input     documents, resulting in possible information disclosure or denial of service (CVE-2017-1000061)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update for xmlsec1 is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

XML Security Library is a C library based on LibXML2 and OpenSSL. The library was created with a goal to support major XML security standards 'XML Digital Signature' and 'XML Encryption'.

Security Fix(es) :

* It was discovered xmlsec1's use of libxml2 inadvertently enabled external entity expansion (XXE) along with validation. An attacker could craft an XML file that would cause xmlsec1 to try and read local files or HTTP/FTP URLs, leading to information disclosure or denial of service. (CVE-2017-1000061)

It was discovered xmlsec1's use of libxml2 inadvertently enabled external entity expansion (XXE) along with validation. An attacker could craft an XML file that would cause xmlsec1 to try and read local files or HTTP/FTP URLs, leading to information disclosure or denial of service. (CVE-2017-1000061)

ID	Name	Product	Family	Published	Updated	Severity
133427	Fedora 31 : xmlsec1 (2020-9573355ff4)	Nessus	Fedora Local Security Checks	2/3/2020	3/28/2024	high
102633	Oracle Linux 7 : xmlsec1 (ELSA-2017-2492)	Nessus	Oracle Linux Local Security Checks	8/22/2017	10/23/2024	high
102677	Scientific Linux Security Update : xmlsec1 on SL7.x x86_64 (20170821)	Nessus	Scientific Linux Local Security Checks	8/22/2017	11/26/2025	high
166108	Ubuntu 16.04 ESM : XML Security Library vulnerability (USN-5674-1)	Nessus	Ubuntu Local Security Checks	10/14/2022	8/28/2024	high
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	6/30/2023	7/6/2023	critical
103031	EulerOS 2.0 SP1 : xmlsec1 (EulerOS-SA-2017-1193)	Nessus	Huawei Local Security Checks	9/8/2017	11/24/2025	high
289530	MiracleLinux 7 : xmlsec1-1.2.20-7.el7 (AXSA:2017-1915:01)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/17/2026	high
102634	RHEL 7 : xmlsec1 (RHSA-2017:2492)	Nessus	Red Hat Local Security Checks	8/22/2017	11/5/2024	high
220133	Linux Distros Unpatched Vulnerability : CVE-2017-1000061	Nessus	Misc.	3/4/2025	9/3/2025	high
102881	CentOS 7 : xmlsec1 (CESA-2017:2492)	Nessus	CentOS Local Security Checks	9/1/2017	12/5/2022	high
103032	EulerOS 2.0 SP2 : xmlsec1 (EulerOS-SA-2017-1194)	Nessus	Huawei Local Security Checks	9/8/2017	11/24/2025	high
103224	Amazon Linux AMI : xmlsec1 (ALAS-2017-890)	Nessus	Amazon Linux Local Security Checks	9/15/2017	11/21/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

critical

high

high

high

high

high

high

high