ID OPENSUSE-SU-2018:3110-1 Type suse Reporter Suse Modified 2018-10-12T12:12:16
Description
This update for libxml2 fixes the following security issues:
CVE-2018-9251: The xz_decomp function allowed remote attackers to cause
a denial of service (infinite loop) via a crafted XML file that triggers
LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint (bsc#1088279)
CVE-2018-14567: Prevent denial of service (infinite loop) via a crafted
XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint
(bsc#1105166)
CVE-2018-14404: Prevent NULL pointer dereference in the
xmlXPathCompOpEval() function when parsing an invalid XPath expression
in the XPATH_OP_AND or XPATH_OP_OR case leading to a denial of service
attack (bsc#1102046)
This update was imported from the SUSE:SLE-15:Update update project.
{"cve": [{"lastseen": "2020-10-03T13:20:14", "description": "libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.", "edition": 5, "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 3.6}, "published": "2018-08-16T20:29:00", "title": "CVE-2018-14567", "type": "cve", "cwe": ["CWE-835"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-14567"], "modified": "2020-09-10T01:15:00", "cpe": ["cpe:/o:canonical:ubuntu_linux:18.04", "cpe:/o:debian:debian_linux:8.0", "cpe:/o:canonical:ubuntu_linux:16.04", "cpe:/a:xmlsoft:libxml2:2.9.8", "cpe:/o:canonical:ubuntu_linux:14.04"], "id": "CVE-2018-14567", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-14567", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "cpe:2.3:a:xmlsoft:libxml2:2.9.8:*:*:*:*:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*"]}, {"lastseen": "2020-12-09T20:25:35", "description": "A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.", "edition": 8, "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2018-07-19T13:29:00", "title": "CVE-2018-14404", "type": "cve", "cwe": ["CWE-476"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": true, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-14404"], "modified": "2020-09-10T01:15:00", "cpe": ["cpe:/o:canonical:ubuntu_linux:18.04", "cpe:/o:canonical:ubuntu_linux:12.04", "cpe:/o:canonical:ubuntu_linux:16.04", "cpe:/a:xmlsoft:libxml2:2.9.8", "cpe:/o:debian:debian_linux:-", "cpe:/o:canonical:ubuntu_linux:14.04"], "id": "CVE-2018-14404", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-14404", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "cpe:2.3:o:debian:debian_linux:-:*:*:*:*:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "cpe:2.3:a:xmlsoft:libxml2:2.9.8:*:*:*:*:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*"]}, {"lastseen": "2020-10-03T13:20:27", "description": "The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.", "edition": 4, "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 5.3, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 3.6}, "published": "2018-04-04T02:29:00", "title": "CVE-2018-9251", "type": "cve", "cwe": ["CWE-835"], "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-9251"], "modified": "2019-10-03T00:03:00", "cpe": ["cpe:/o:debian:debian_linux:8.0", "cpe:/a:xmlsoft:libxml2:2.9.8"], "id": "CVE-2018-9251", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-9251", "cvss": {"score": 2.6, "vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:a:xmlsoft:libxml2:2.9.8:*:*:*:*:*:*:*"]}], "nessus": [{"lastseen": "2021-01-20T12:34:07", "description": "This update for libxml2 fixes the following security issues :\n\n - CVE-2018-9251: The xz_decomp function allowed remote\n attackers to cause a denial of service (infinite loop)\n via a crafted XML file that triggers\n LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n (bsc#1088279)\n\n - CVE-2018-14567: Prevent denial of service (infinite\n loop) via a crafted XML file that triggers\n LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n (bsc#1105166)\n\n - CVE-2018-14404: Prevent NULL pointer dereference in the\n xmlXPathCompOpEval() function when parsing an invalid\n XPath expression in the XPATH_OP_AND or XPATH_OP_OR case\n leading to a denial of service attack (bsc#1102046)\n\nThis update was imported from the SUSE:SLE-15:Update update project.", "edition": 14, "cvss3": {"score": 7.5, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "published": "2018-10-15T00:00:00", "title": "openSUSE Security Update : libxml2 (openSUSE-2018-1150)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14404", "CVE-2018-14567", "CVE-2018-9251"], "modified": "2018-10-15T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:libxml2-2-debuginfo", "p-cpe:/a:novell:opensuse:libxml2-2-32bit-debuginfo", "p-cpe:/a:novell:opensuse:python-libxml2-python-debugsource", "cpe:/o:novell:opensuse:15.0", "p-cpe:/a:novell:opensuse:libxml2-2", "p-cpe:/a:novell:opensuse:python2-libxml2-python-debuginfo", "p-cpe:/a:novell:opensuse:libxml2-devel-32bit", "p-cpe:/a:novell:opensuse:libxml2-debugsource", "p-cpe:/a:novell:opensuse:libxml2-devel", "p-cpe:/a:novell:opensuse:python3-libxml2-python-debuginfo", "p-cpe:/a:novell:opensuse:libxml2-2-32bit", "p-cpe:/a:novell:opensuse:python2-libxml2-python", "p-cpe:/a:novell:opensuse:libxml2-tools-debuginfo", "p-cpe:/a:novell:opensuse:libxml2-tools", "p-cpe:/a:novell:opensuse:python3-libxml2-python"], "id": "OPENSUSE-2018-1150.NASL", "href": "https://www.tenable.com/plugins/nessus/118116", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2018-1150.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(118116);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2018-14404\", \"CVE-2018-14567\", \"CVE-2018-9251\");\n\n script_name(english:\"openSUSE Security Update : libxml2 (openSUSE-2018-1150)\");\n script_summary(english:\"Check for the openSUSE-2018-1150 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for libxml2 fixes the following security issues :\n\n - CVE-2018-9251: The xz_decomp function allowed remote\n attackers to cause a denial of service (infinite loop)\n via a crafted XML file that triggers\n LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n (bsc#1088279)\n\n - CVE-2018-14567: Prevent denial of service (infinite\n loop) via a crafted XML file that triggers\n LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n (bsc#1105166)\n\n - CVE-2018-14404: Prevent NULL pointer dereference in the\n xmlXPathCompOpEval() function when parsing an invalid\n XPath expression in the XPATH_OP_AND or XPATH_OP_OR case\n leading to a denial of service attack (bsc#1102046)\n\nThis update was imported from the SUSE:SLE-15:Update update project.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1088279\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1102046\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1105166\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libxml2 packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-2-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-2-32bit-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-2-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-devel-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-tools-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python-libxml2-python-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python2-libxml2-python\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python2-libxml2-python-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python3-libxml2-python\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python3-libxml2-python-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/10/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/10/15\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.0)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.0\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libxml2-2-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libxml2-2-debuginfo-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libxml2-debugsource-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libxml2-devel-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libxml2-tools-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libxml2-tools-debuginfo-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"python-libxml2-python-debugsource-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"python2-libxml2-python-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"python2-libxml2-python-debuginfo-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"python3-libxml2-python-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"python3-libxml2-python-debuginfo-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", cpu:\"x86_64\", reference:\"libxml2-2-32bit-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", cpu:\"x86_64\", reference:\"libxml2-2-32bit-debuginfo-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", cpu:\"x86_64\", reference:\"libxml2-devel-32bit-2.9.7-lp150.2.3.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libxml2-2 / libxml2-2-debuginfo / libxml2-debugsource / etc\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-01-20T12:54:00", "description": "This update for libxml2 fixes the following security issues :\n\n - CVE-2018-9251: The xz_decomp function allowed remote\n attackers to cause a denial of service (infinite loop)\n via a crafted XML file that triggers\n LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n (bsc#1088279)\n\n - CVE-2018-14567: Prevent denial of service (infinite\n loop) via a crafted XML file that triggers\n LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n (bsc#1105166)\n\n - CVE-2018-14404: Prevent NULL pointer dereference in the\n xmlXPathCompOpEval() function when parsing an invalid\n XPath expression in the XPATH_OP_AND or XPATH_OP_OR case\n leading to a denial of service attack (bsc#1102046)\n\nThis update was imported from the SUSE:SLE-15:Update update project.", "edition": 15, "cvss3": {"score": 7.5, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "published": "2019-03-27T00:00:00", "title": "openSUSE Security Update : libxml2 (openSUSE-2019-785)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14404", "CVE-2018-14567", "CVE-2018-9251"], "modified": "2019-03-27T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:libxml2-2-debuginfo", "p-cpe:/a:novell:opensuse:libxml2-2-32bit-debuginfo", "p-cpe:/a:novell:opensuse:python-libxml2-python-debugsource", "cpe:/o:novell:opensuse:15.0", "p-cpe:/a:novell:opensuse:libxml2-2", "p-cpe:/a:novell:opensuse:python2-libxml2-python-debuginfo", "p-cpe:/a:novell:opensuse:libxml2-devel-32bit", "p-cpe:/a:novell:opensuse:libxml2-debugsource", "p-cpe:/a:novell:opensuse:libxml2-devel", "p-cpe:/a:novell:opensuse:python3-libxml2-python-debuginfo", "p-cpe:/a:novell:opensuse:libxml2-2-32bit", "p-cpe:/a:novell:opensuse:python2-libxml2-python", "p-cpe:/a:novell:opensuse:libxml2-tools-debuginfo", "p-cpe:/a:novell:opensuse:libxml2-tools", "p-cpe:/a:novell:opensuse:python3-libxml2-python"], "id": "OPENSUSE-2019-785.NASL", "href": "https://www.tenable.com/plugins/nessus/123336", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2019-785.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(123336);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2018-14404\", \"CVE-2018-14567\", \"CVE-2018-9251\");\n\n script_name(english:\"openSUSE Security Update : libxml2 (openSUSE-2019-785)\");\n script_summary(english:\"Check for the openSUSE-2019-785 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for libxml2 fixes the following security issues :\n\n - CVE-2018-9251: The xz_decomp function allowed remote\n attackers to cause a denial of service (infinite loop)\n via a crafted XML file that triggers\n LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n (bsc#1088279)\n\n - CVE-2018-14567: Prevent denial of service (infinite\n loop) via a crafted XML file that triggers\n LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n (bsc#1105166)\n\n - CVE-2018-14404: Prevent NULL pointer dereference in the\n xmlXPathCompOpEval() function when parsing an invalid\n XPath expression in the XPATH_OP_AND or XPATH_OP_OR case\n leading to a denial of service attack (bsc#1102046)\n\nThis update was imported from the SUSE:SLE-15:Update update project.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1088279\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1102046\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1105166\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libxml2 packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-2-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-2-32bit-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-2-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-devel-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-tools-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python-libxml2-python-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python2-libxml2-python\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python2-libxml2-python-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python3-libxml2-python\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python3-libxml2-python-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/04/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/03/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/03/27\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.0)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.0\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libxml2-2-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libxml2-2-debuginfo-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libxml2-debugsource-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libxml2-devel-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libxml2-tools-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libxml2-tools-debuginfo-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"python-libxml2-python-debugsource-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"python2-libxml2-python-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"python2-libxml2-python-debuginfo-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"python3-libxml2-python-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"python3-libxml2-python-debuginfo-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", cpu:\"x86_64\", reference:\"libxml2-2-32bit-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", cpu:\"x86_64\", reference:\"libxml2-2-32bit-debuginfo-2.9.7-lp150.2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", cpu:\"x86_64\", reference:\"libxml2-devel-32bit-2.9.7-lp150.2.3.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libxml2-2 / libxml2-2-32bit / libxml2-2-32bit-debuginfo / etc\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-03-18T03:02:35", "description": "This update for libxml2 fixes the following security issues :\n\nCVE-2018-9251: The xz_decomp function allowed remote attackers to\ncause a denial of service (infinite loop) via a crafted XML file that\ntriggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint (bsc#1088279)\n\nCVE-2018-14567: Prevent denial of service (infinite loop) via a\ncrafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by\nxmllint (bsc#1105166)\n\nCVE-2018-14404: Prevent NULL pointer dereference in the\nxmlXPathCompOpEval() function when parsing an invalid XPath expression\nin the XPATH_OP_AND or XPATH_OP_OR case leading to a denial of service\nattack (bsc#1102046)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 9, "cvss3": {"score": 7.5, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "published": "2019-01-02T00:00:00", "title": "SUSE SLED15 / SLES15 Security Update : libxml2 (SUSE-SU-2018:3080-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14404", "CVE-2018-14567", "CVE-2018-9251"], "modified": "2019-01-02T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:libxml2-2-debuginfo", "p-cpe:/a:novell:suse_linux:python2-libxml2-python", "cpe:/o:novell:suse_linux:15", "p-cpe:/a:novell:suse_linux:libxml2-2", "p-cpe:/a:novell:suse_linux:libxml2", "p-cpe:/a:novell:suse_linux:python3-libxml2-python", "p-cpe:/a:novell:suse_linux:python2-libxml2-python-debuginfo", "p-cpe:/a:novell:suse_linux:libxml2-devel", "p-cpe:/a:novell:suse_linux:libxml2-tools", "p-cpe:/a:novell:suse_linux:libxml2-2-32bit-debuginfo", "p-cpe:/a:novell:suse_linux:python-libxml2-python-debugsource", "p-cpe:/a:novell:suse_linux:libxml2-debugsource", "p-cpe:/a:novell:suse_linux:libxml2-tools-debuginfo", "p-cpe:/a:novell:suse_linux:python3-libxml2-python-debuginfo"], "id": "SUSE_SU-2018-3080-1.NASL", "href": "https://www.tenable.com/plugins/nessus/120125", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2018:3080-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(120125);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/03/16\");\n\n script_cve_id(\"CVE-2018-14404\", \"CVE-2018-14567\", \"CVE-2018-9251\");\n\n script_name(english:\"SUSE SLED15 / SLES15 Security Update : libxml2 (SUSE-SU-2018:3080-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for libxml2 fixes the following security issues :\n\nCVE-2018-9251: The xz_decomp function allowed remote attackers to\ncause a denial of service (infinite loop) via a crafted XML file that\ntriggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint (bsc#1088279)\n\nCVE-2018-14567: Prevent denial of service (infinite loop) via a\ncrafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by\nxmllint (bsc#1105166)\n\nCVE-2018-14404: Prevent NULL pointer dereference in the\nxmlXPathCompOpEval() function when parsing an invalid XPath expression\nin the XPATH_OP_AND or XPATH_OP_OR case leading to a denial of service\nattack (bsc#1102046)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1088279\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1102046\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1105166\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-14404/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-14567/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-9251/\"\n );\n # https://www.suse.com/support/update/announcement/2018/suse-su-20183080-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?d57ed144\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Module for Basesystem 15:zypper in -t patch\nSUSE-SLE-Module-Basesystem-15-2018-2182=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libxml2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libxml2-2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libxml2-2-32bit-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libxml2-2-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libxml2-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libxml2-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libxml2-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libxml2-tools-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:python-libxml2-python-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:python2-libxml2-python\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:python2-libxml2-python-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:python3-libxml2-python\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:python3-libxml2-python-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:15\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/04/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/10/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/01/02\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED15|SLES15)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED15 / SLES15\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES15\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES15 SP0\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED15\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED15 SP0\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"x86_64\", reference:\"libxml2-2-32bit-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"x86_64\", reference:\"libxml2-2-32bit-debuginfo-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libxml2-2-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libxml2-2-debuginfo-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libxml2-debugsource-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libxml2-devel-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libxml2-tools-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libxml2-tools-debuginfo-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"python-libxml2-python-debugsource-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"python2-libxml2-python-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"python2-libxml2-python-debuginfo-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"python3-libxml2-python-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"python3-libxml2-python-debuginfo-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", cpu:\"x86_64\", reference:\"libxml2-2-32bit-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", cpu:\"x86_64\", reference:\"libxml2-2-32bit-debuginfo-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libxml2-2-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libxml2-2-debuginfo-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libxml2-debugsource-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libxml2-devel-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libxml2-tools-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libxml2-tools-debuginfo-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"python-libxml2-python-debugsource-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"python2-libxml2-python-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"python2-libxml2-python-debuginfo-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"python3-libxml2-python-2.9.7-3.3.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"python3-libxml2-python-debuginfo-2.9.7-3.3.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libxml2\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-01-20T12:34:07", "description": "This update for libxml2 fixes the following security issues :\n\n - CVE-2018-9251: The xz_decomp function allowed remote\n attackers to cause a denial of service (infinite loop)\n via a crafted XML file that triggers\n LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n (bsc#1088279).\n\n - CVE-2018-14567: Prevent denial of service (infinite\n loop) via a crafted XML file that triggers\n LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n (bsc#1105166).\n\n - CVE-2018-14404: Prevent NULL pointer dereference in the\n xmlXPathCompOpEval() function when parsing an invalid\n XPath expression in the XPATH_OP_AND or XPATH_OP_OR case\n leading to a denial of service attack (bsc#1102046).\n\n - CVE-2017-18258: The xz_head function allowed remote\n attackers to cause a denial of service (memory\n consumption) via a crafted LZMA file, because the\n decoder functionality did not restrict memory usage to\n what is required for a legitimate file (bsc#1088601).\n\nThis update was imported from the SUSE:SLE-12-SP2:Update update\nproject.", "edition": 14, "cvss3": {"score": 7.5, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "published": "2018-10-15T00:00:00", "title": "openSUSE Security Update : libxml2 (openSUSE-2018-1149)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14404", "CVE-2018-14567", "CVE-2018-9251", "CVE-2017-18258"], "modified": "2018-10-15T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:libxml2-2-debuginfo", "p-cpe:/a:novell:opensuse:python-libxml2-debuginfo", "p-cpe:/a:novell:opensuse:python-libxml2", "p-cpe:/a:novell:opensuse:libxml2-2", "p-cpe:/a:novell:opensuse:libxml2-devel-32bit", "p-cpe:/a:novell:opensuse:libxml2-debugsource", "p-cpe:/a:novell:opensuse:libxml2-devel", "p-cpe:/a:novell:opensuse:libxml2-2-32bit", "cpe:/o:novell:opensuse:42.3", "p-cpe:/a:novell:opensuse:python-libxml2-debugsource", "p-cpe:/a:novell:opensuse:libxml2-tools-debuginfo", "p-cpe:/a:novell:opensuse:libxml2-tools", "p-cpe:/a:novell:opensuse:libxml2-2-debuginfo-32bit"], "id": "OPENSUSE-2018-1149.NASL", "href": "https://www.tenable.com/plugins/nessus/118115", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2018-1149.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(118115);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2017-18258\", \"CVE-2018-14404\", \"CVE-2018-14567\", \"CVE-2018-9251\");\n\n script_name(english:\"openSUSE Security Update : libxml2 (openSUSE-2018-1149)\");\n script_summary(english:\"Check for the openSUSE-2018-1149 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for libxml2 fixes the following security issues :\n\n - CVE-2018-9251: The xz_decomp function allowed remote\n attackers to cause a denial of service (infinite loop)\n via a crafted XML file that triggers\n LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n (bsc#1088279).\n\n - CVE-2018-14567: Prevent denial of service (infinite\n loop) via a crafted XML file that triggers\n LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n (bsc#1105166).\n\n - CVE-2018-14404: Prevent NULL pointer dereference in the\n xmlXPathCompOpEval() function when parsing an invalid\n XPath expression in the XPATH_OP_AND or XPATH_OP_OR case\n leading to a denial of service attack (bsc#1102046).\n\n - CVE-2017-18258: The xz_head function allowed remote\n attackers to cause a denial of service (memory\n consumption) via a crafted LZMA file, because the\n decoder functionality did not restrict memory usage to\n what is required for a legitimate file (bsc#1088601).\n\nThis update was imported from the SUSE:SLE-12-SP2:Update update\nproject.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1088279\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1088601\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1102046\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1105166\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libxml2 packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-2-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-2-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-2-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-devel-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libxml2-tools-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python-libxml2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python-libxml2-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:python-libxml2-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.3\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/10/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/10/15\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.3)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.3\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libxml2-2-2.9.4-18.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libxml2-2-debuginfo-2.9.4-18.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libxml2-debugsource-2.9.4-18.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libxml2-devel-2.9.4-18.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libxml2-tools-2.9.4-18.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libxml2-tools-debuginfo-2.9.4-18.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"python-libxml2-2.9.4-18.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"python-libxml2-debuginfo-2.9.4-18.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"python-libxml2-debugsource-2.9.4-18.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", cpu:\"x86_64\", reference:\"libxml2-2-32bit-2.9.4-18.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", cpu:\"x86_64\", reference:\"libxml2-2-debuginfo-32bit-2.9.4-18.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", cpu:\"x86_64\", reference:\"libxml2-devel-32bit-2.9.4-18.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libxml2-2 / libxml2-2-32bit / libxml2-2-debuginfo / etc\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-01-14T06:15:44", "description": "This update for libxml2 fixes the following security issues :\n\nCVE-2018-9251: The xz_decomp function allowed remote attackers to\ncause a denial of service (infinite loop) via a crafted XML file that\ntriggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n(bsc#1088279).\n\nCVE-2018-14567: Prevent denial of service (infinite loop) via a\ncrafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by\nxmllint (bsc#1105166).\n\nCVE-2018-14404: Prevent NULL pointer dereference in the\nxmlXPathCompOpEval() function when parsing an invalid XPath expression\nin the XPATH_OP_AND or XPATH_OP_OR case leading to a denial of service\nattack (bsc#1102046).\n\nCVE-2017-18258: The xz_head function allowed remote attackers to cause\na denial of service (memory consumption) via a crafted LZMA file,\nbecause the decoder functionality did not restrict memory usage to\nwhat is required for a legitimate file (bsc#1088601).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 21, "cvss3": {"score": 7.5, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "published": "2018-10-10T00:00:00", "title": "SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2018:3081-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14404", "CVE-2018-14567", "CVE-2018-9251", "CVE-2017-18258"], "modified": "2018-10-10T00:00:00", "cpe": ["cpe:/o:novell:suse_linux:12", "p-cpe:/a:novell:suse_linux:libxml2-2-debuginfo", "p-cpe:/a:novell:suse_linux:python-libxml2", "p-cpe:/a:novell:suse_linux:libxml2-2", "p-cpe:/a:novell:suse_linux:libxml2", "p-cpe:/a:novell:suse_linux:python-libxml2-debugsource", "p-cpe:/a:novell:suse_linux:python-libxml2-debuginfo", "p-cpe:/a:novell:suse_linux:libxml2-tools", "p-cpe:/a:novell:suse_linux:libxml2-debugsource", "p-cpe:/a:novell:suse_linux:libxml2-tools-debuginfo"], "id": "SUSE_SU-2018-3081-1.NASL", "href": "https://www.tenable.com/plugins/nessus/118032", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2018:3081-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(118032);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/13\");\n\n script_cve_id(\"CVE-2017-18258\", \"CVE-2018-14404\", \"CVE-2018-14567\", \"CVE-2018-9251\");\n\n script_name(english:\"SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2018:3081-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"This update for libxml2 fixes the following security issues :\n\nCVE-2018-9251: The xz_decomp function allowed remote attackers to\ncause a denial of service (infinite loop) via a crafted XML file that\ntriggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n(bsc#1088279).\n\nCVE-2018-14567: Prevent denial of service (infinite loop) via a\ncrafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by\nxmllint (bsc#1105166).\n\nCVE-2018-14404: Prevent NULL pointer dereference in the\nxmlXPathCompOpEval() function when parsing an invalid XPath expression\nin the XPATH_OP_AND or XPATH_OP_OR case leading to a denial of service\nattack (bsc#1102046).\n\nCVE-2017-18258: The xz_head function allowed remote attackers to cause\na denial of service (memory consumption) via a crafted LZMA file,\nbecause the decoder functionality did not restrict memory usage to\nwhat is required for a legitimate file (bsc#1088601).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1088279\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1088601\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1102046\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1105166\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-18258/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-14404/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-14567/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-9251/\"\n );\n # https://www.suse.com/support/update/announcement/2018/suse-su-20183081-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?01eed67d\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Software Development Kit 12-SP3:zypper in -t\npatch SUSE-SLE-SDK-12-SP3-2018-2181=1\n\nSUSE Linux Enterprise Server 12-SP3:zypper in -t patch\nSUSE-SLE-SERVER-12-SP3-2018-2181=1\n\nSUSE Linux Enterprise Desktop 12-SP3:zypper in -t patch\nSUSE-SLE-DESKTOP-12-SP3-2018-2181=1\n\nSUSE CaaS Platform ALL :\n\nTo install this update, use the SUSE CaaS Platform Velum dashboard. It\nwill inform you if it detects new updates and let you then trigger\nupdating of the complete cluster in a controlled way.\n\nSUSE CaaS Platform 3.0 :\n\nTo install this update, use the SUSE CaaS Platform Velum dashboard. It\nwill inform you if it detects new updates and let you then trigger\nupdating of the complete cluster in a controlled way.\n\nOpenStack Cloud Magnum Orchestration 7:zypper in -t patch\nSUSE-OpenStack-Cloud-Magnum-Orchestration-7-2018-2181=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libxml2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libxml2-2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libxml2-2-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libxml2-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libxml2-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libxml2-tools-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:python-libxml2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:python-libxml2-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:python-libxml2-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/04/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/10/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/10/10\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED12|SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED12 / SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(3)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP3\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED12\" && (! preg(pattern:\"^(3)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED12 SP3\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libxml2-2-2.9.4-46.15.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libxml2-2-32bit-2.9.4-46.15.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libxml2-2-debuginfo-2.9.4-46.15.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libxml2-2-debuginfo-32bit-2.9.4-46.15.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libxml2-debugsource-2.9.4-46.15.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libxml2-tools-2.9.4-46.15.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libxml2-tools-debuginfo-2.9.4-46.15.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"python-libxml2-2.9.4-46.15.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"python-libxml2-debuginfo-2.9.4-46.15.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"python-libxml2-debugsource-2.9.4-46.15.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libxml2-2-2.9.4-46.15.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libxml2-2-32bit-2.9.4-46.15.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libxml2-2-debuginfo-2.9.4-46.15.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libxml2-2-debuginfo-32bit-2.9.4-46.15.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libxml2-debugsource-2.9.4-46.15.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libxml2-tools-2.9.4-46.15.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libxml2-tools-debuginfo-2.9.4-46.15.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"python-libxml2-2.9.4-46.15.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"python-libxml2-debuginfo-2.9.4-46.15.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"python-libxml2-debugsource-2.9.4-46.15.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libxml2\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-01-12T09:39:54", "description": "CVE-2018-14404 Fix of a NULL pointer dereference which might result in\na crash and thus in a denial of service.\n\nCVE-2018-14567 and CVE-2018-9251 Approvement in LZMA error handling\nwhich prevents an infinite loop.\n\nCVE-2017-18258 Limit available memory to 100MB to avoid exhaustive\nmemory consumption by malicious files.\n\nFor Debian 8 'Jessie', these problems have been fixed in version\n2.9.1+dfsg1-5+deb8u7.\n\nWe recommend that you upgrade your libxml2 packages.\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.", "edition": 18, "cvss3": {"score": 7.5, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "published": "2018-09-28T00:00:00", "title": "Debian DLA-1524-1 : libxml2 security update", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14404", "CVE-2018-14567", "CVE-2018-9251", "CVE-2017-18258"], "modified": "2018-09-28T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:libxml2-dbg", "cpe:/o:debian:debian_linux:8.0", "p-cpe:/a:debian:debian_linux:python-libxml2", "p-cpe:/a:debian:debian_linux:python-libxml2-dbg", "p-cpe:/a:debian:debian_linux:libxml2-utils-dbg", "p-cpe:/a:debian:debian_linux:libxml2-dev", "p-cpe:/a:debian:debian_linux:libxml2", "p-cpe:/a:debian:debian_linux:libxml2-doc", "p-cpe:/a:debian:debian_linux:libxml2-utils"], "id": "DEBIAN_DLA-1524.NASL", "href": "https://www.tenable.com/plugins/nessus/117811", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Debian Security Advisory DLA-1524-1. The text\n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(117811);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2017-18258\", \"CVE-2018-14404\", \"CVE-2018-14567\", \"CVE-2018-9251\");\n\n script_name(english:\"Debian DLA-1524-1 : libxml2 security update\");\n script_summary(english:\"Checks dpkg output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"CVE-2018-14404 Fix of a NULL pointer dereference which might result in\na crash and thus in a denial of service.\n\nCVE-2018-14567 and CVE-2018-9251 Approvement in LZMA error handling\nwhich prevents an infinite loop.\n\nCVE-2017-18258 Limit available memory to 100MB to avoid exhaustive\nmemory consumption by malicious files.\n\nFor Debian 8 'Jessie', these problems have been fixed in version\n2.9.1+dfsg1-5+deb8u7.\n\nWe recommend that you upgrade your libxml2 packages.\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/jessie/libxml2\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Upgrade the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libxml2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libxml2-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libxml2-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libxml2-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libxml2-utils\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libxml2-utils-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:python-libxml2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:python-libxml2-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:8.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/09/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/09/28\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"8.0\", prefix:\"libxml2\", reference:\"2.9.1+dfsg1-5+deb8u7\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libxml2-dbg\", reference:\"2.9.1+dfsg1-5+deb8u7\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libxml2-dev\", reference:\"2.9.1+dfsg1-5+deb8u7\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libxml2-doc\", reference:\"2.9.1+dfsg1-5+deb8u7\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libxml2-utils\", reference:\"2.9.1+dfsg1-5+deb8u7\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libxml2-utils-dbg\", reference:\"2.9.1+dfsg1-5+deb8u7\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"python-libxml2\", reference:\"2.9.1+dfsg1-5+deb8u7\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"python-libxml2-dbg\", reference:\"2.9.1+dfsg1-5+deb8u7\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-01-07T10:17:01", "description": "Fix few CVEs\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.", "edition": 11, "cvss3": {"score": 7.5, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "published": "2019-01-03T00:00:00", "title": "Fedora 28 : libxml2 (2018-3b782350ff)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14404", "CVE-2018-9251"], "modified": "2019-01-03T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:libxml2", "cpe:/o:fedoraproject:fedora:28"], "id": "FEDORA_2018-3B782350FF.NASL", "href": "https://www.tenable.com/plugins/nessus/120363", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2018-3b782350ff.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(120363);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2018-14404\", \"CVE-2018-9251\");\n script_xref(name:\"FEDORA\", value:\"2018-3b782350ff\");\n\n script_name(english:\"Fedora 28 : libxml2 (2018-3b782350ff)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Fix few CVEs\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2018-3b782350ff\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libxml2 package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:libxml2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:28\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/04/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/08/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/01/03\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^28([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 28\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC28\", reference:\"libxml2-2.9.8-4.fc28\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libxml2\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-01-07T10:21:59", "description": "Fix few CVEs\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.", "edition": 19, "cvss3": {"score": 7.5, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "published": "2018-08-10T00:00:00", "title": "Fedora 27 : libxml2 (2018-e198cf4a64)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14404", "CVE-2018-9251"], "modified": "2018-08-10T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:libxml2", "cpe:/o:fedoraproject:fedora:27"], "id": "FEDORA_2018-E198CF4A64.NASL", "href": "https://www.tenable.com/plugins/nessus/111621", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2018-e198cf4a64.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(111621);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2018-14404\", \"CVE-2018-9251\");\n script_xref(name:\"FEDORA\", value:\"2018-e198cf4a64\");\n\n script_name(english:\"Fedora 27 : libxml2 (2018-e198cf4a64)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Fix few CVEs\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2018-e198cf4a64\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libxml2 package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:libxml2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:27\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/04/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/08/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/08/10\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^27([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 27\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC27\", reference:\"libxml2-2.9.8-4.fc27\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libxml2\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-11-21T06:00:05", "description": "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2020:1827 advisory.\n\n - libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c (CVE-2018-14404)\n\n - libxml2: infinite loop in xz_decomp function in xzlib.c (CVE-2018-9251)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.", "edition": 2, "cvss3": {"score": 7.5, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "published": "2020-11-18T00:00:00", "title": "RHEL 8 : libxml2 (RHSA-2020:1827)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14404", "CVE-2018-9251"], "modified": "2020-11-18T00:00:00", "cpe": ["cpe:/o:redhat:rhel_tus:8.2", "cpe:/a:redhat:rhel_e4s:8.2::appstream", "cpe:/o:redhat:rhel_eus:8.4", "cpe:/a:redhat:rhel_eus:8.4::appstream", "cpe:/o:redhat:rhel_eus:8.2::baseos", "cpe:/o:redhat:enterprise_linux:8::baseos", "cpe:/o:redhat:rhel_e4s:8.2", "p-cpe:/a:redhat:enterprise_linux:libxml2-devel", "cpe:/o:redhat:rhel_aus:8.2::baseos", "p-cpe:/a:redhat:enterprise_linux:python3-libxml2", "cpe:/a:redhat:rhel_tus:8.2::appstream", "cpe:/a:redhat:enterprise_linux:8::appstream", "cpe:/o:redhat:rhel_tus:8.2::baseos", "cpe:/o:redhat:rhel_aus:8.2", "cpe:/a:redhat:rhel_aus:8.2::appstream", "p-cpe:/a:redhat:enterprise_linux:libxml2", "p-cpe:/a:redhat:enterprise_linux:libxml2-debugsource", "cpe:/o:redhat:enterprise_linux:8", "cpe:/o:redhat:rhel_eus:8.2", "cpe:/o:redhat:rhel_e4s:8.2::baseos", "cpe:/a:redhat:rhel_eus:8.2::appstream", "cpe:/o:redhat:rhel_eus:8.4::baseos"], "id": "REDHAT-RHSA-2020-1827.NASL", "href": "https://www.tenable.com/plugins/nessus/143009", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2020:1827. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(143009);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/11/19\");\n\n script_cve_id(\"CVE-2018-9251\", \"CVE-2018-14404\");\n script_xref(name:\"RHSA\", value:\"2020:1827\");\n\n script_name(english:\"RHEL 8 : libxml2 (RHSA-2020:1827)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2020:1827 advisory.\n\n - libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c (CVE-2018-14404)\n\n - libxml2: infinite loop in xz_decomp function in xzlib.c (CVE-2018-9251)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/476.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/835.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2018-9251\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2018-14404\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2020:1827\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1565318\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1595985\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-14404\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_cwe_id(476, 835);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/04/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/04/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/11/18\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:8::baseos\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.2::baseos\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.2::baseos\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.2::baseos\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.4::baseos\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.2::baseos\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:redhat:enterprise_linux:8::appstream\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:redhat:rhel_aus:8.2::appstream\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:redhat:rhel_e4s:8.2::appstream\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:redhat:rhel_eus:8.2::appstream\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:redhat:rhel_eus:8.4::appstream\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:redhat:rhel_tus:8.2::appstream\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libxml2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libxml2-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libxml2-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:python3-libxml2\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item('Host/RedHat/release');\nif (isnull(release) || 'Red Hat' >!< release) audit(AUDIT_OS_NOT, 'Red Hat');\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^8([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Red Hat 8.x', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nrepositories = {\n 'enterprise_linux_8_appstream': [\n 'rhel-8-for-aarch64-appstream-debug-rpms',\n 'rhel-8-for-aarch64-appstream-rpms',\n 'rhel-8-for-aarch64-appstream-source-rpms',\n 'rhel-8-for-s390x-appstream-debug-rpms',\n 'rhel-8-for-s390x-appstream-rpms',\n 'rhel-8-for-s390x-appstream-source-rpms',\n 'rhel-8-for-x86_64-appstream-debug-rpms',\n 'rhel-8-for-x86_64-appstream-rpms',\n 'rhel-8-for-x86_64-appstream-source-rpms'\n ],\n 'enterprise_linux_8_baseos': [\n 'rhel-8-for-aarch64-baseos-debug-rpms',\n 'rhel-8-for-aarch64-baseos-rpms',\n 'rhel-8-for-aarch64-baseos-source-rpms',\n 'rhel-8-for-s390x-baseos-debug-rpms',\n 'rhel-8-for-s390x-baseos-rpms',\n 'rhel-8-for-s390x-baseos-source-rpms',\n 'rhel-8-for-x86_64-baseos-debug-rpms',\n 'rhel-8-for-x86_64-baseos-rpms',\n 'rhel-8-for-x86_64-baseos-source-rpms'\n ],\n 'rhel_eus_8_2_appstream': [\n 'rhel-8-for-aarch64-appstream-eus-debug-rpms',\n 'rhel-8-for-aarch64-appstream-eus-rpms',\n 'rhel-8-for-aarch64-appstream-eus-source-rpms',\n 'rhel-8-for-s390x-appstream-eus-debug-rpms',\n 'rhel-8-for-s390x-appstream-eus-rpms',\n 'rhel-8-for-s390x-appstream-eus-source-rpms',\n 'rhel-8-for-x86_64-appstream-aus-debug-rpms',\n 'rhel-8-for-x86_64-appstream-aus-rpms',\n 'rhel-8-for-x86_64-appstream-aus-source-rpms',\n 'rhel-8-for-x86_64-appstream-e4s-debug-rpms',\n 'rhel-8-for-x86_64-appstream-e4s-rpms',\n 'rhel-8-for-x86_64-appstream-e4s-source-rpms',\n 'rhel-8-for-x86_64-appstream-eus-debug-rpms',\n 'rhel-8-for-x86_64-appstream-eus-rpms',\n 'rhel-8-for-x86_64-appstream-eus-source-rpms',\n 'rhel-8-for-x86_64-appstream-tus-debug-rpms',\n 'rhel-8-for-x86_64-appstream-tus-rpms',\n 'rhel-8-for-x86_64-appstream-tus-source-rpms'\n ],\n 'rhel_eus_8_2_baseos': [\n 'rhel-8-for-aarch64-baseos-eus-debug-rpms',\n 'rhel-8-for-aarch64-baseos-eus-rpms',\n 'rhel-8-for-aarch64-baseos-eus-source-rpms',\n 'rhel-8-for-s390x-baseos-eus-debug-rpms',\n 'rhel-8-for-s390x-baseos-eus-rpms',\n 'rhel-8-for-s390x-baseos-eus-source-rpms',\n 'rhel-8-for-x86_64-baseos-aus-debug-rpms',\n 'rhel-8-for-x86_64-baseos-aus-rpms',\n 'rhel-8-for-x86_64-baseos-aus-source-rpms',\n 'rhel-8-for-x86_64-baseos-e4s-debug-rpms',\n 'rhel-8-for-x86_64-baseos-e4s-rpms',\n 'rhel-8-for-x86_64-baseos-e4s-source-rpms',\n 'rhel-8-for-x86_64-baseos-eus-debug-rpms',\n 'rhel-8-for-x86_64-baseos-eus-rpms',\n 'rhel-8-for-x86_64-baseos-eus-source-rpms',\n 'rhel-8-for-x86_64-baseos-tus-debug-rpms',\n 'rhel-8-for-x86_64-baseos-tus-rpms',\n 'rhel-8-for-x86_64-baseos-tus-source-rpms'\n ]\n};\n\nfound_repos = NULL;\nhost_repo_list = get_kb_list('Host/RedHat/repo-list/*');\nif (!(empty_or_null(host_repo_list))) {\n found_repos = make_list();\n foreach repo_key (keys(repositories)) {\n foreach repo ( repositories[repo_key] ) {\n if (get_kb_item('Host/RedHat/repo-list/' + repo)) {\n append_element(var:found_repos, value:repo_key);\n break;\n }\n }\n }\n if(empty_or_null(found_repos)) audit(AUDIT_RHSA_NOT_AFFECTED, 'RHSA-2020:1827');\n}\n\npkgs = [\n {'reference':'libxml2-2.9.7-7.el8', 'cpu':'aarch64', 'release':'8', 'el_string':'el8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'rhel_eus_8_2_appstream', 'rhel_eus_8_2_baseos']},\n {'reference':'libxml2-2.9.7-7.el8', 'cpu':'i686', 'release':'8', 'el_string':'el8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'rhel_eus_8_2_appstream', 'rhel_eus_8_2_baseos']},\n {'reference':'libxml2-2.9.7-7.el8', 'cpu':'s390x', 'release':'8', 'el_string':'el8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'rhel_eus_8_2_appstream', 'rhel_eus_8_2_baseos']},\n {'reference':'libxml2-2.9.7-7.el8', 'cpu':'x86_64', 'release':'8', 'el_string':'el8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'rhel_eus_8_2_appstream', 'rhel_eus_8_2_baseos']},\n {'reference':'libxml2-debugsource-2.9.7-7.el8', 'cpu':'aarch64', 'release':'8', 'el_string':'el8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'rhel_eus_8_2_appstream', 'rhel_eus_8_2_baseos']},\n {'reference':'libxml2-debugsource-2.9.7-7.el8', 'cpu':'i686', 'release':'8', 'el_string':'el8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'rhel_eus_8_2_appstream', 'rhel_eus_8_2_baseos']},\n {'reference':'libxml2-debugsource-2.9.7-7.el8', 'cpu':'s390x', 'release':'8', 'el_string':'el8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'rhel_eus_8_2_appstream', 'rhel_eus_8_2_baseos']},\n {'reference':'libxml2-debugsource-2.9.7-7.el8', 'cpu':'x86_64', 'release':'8', 'el_string':'el8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'rhel_eus_8_2_appstream', 'rhel_eus_8_2_baseos']},\n {'reference':'libxml2-devel-2.9.7-7.el8', 'cpu':'aarch64', 'release':'8', 'el_string':'el8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'rhel_eus_8_2_appstream', 'rhel_eus_8_2_baseos']},\n {'reference':'libxml2-devel-2.9.7-7.el8', 'cpu':'i686', 'release':'8', 'el_string':'el8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'rhel_eus_8_2_appstream', 'rhel_eus_8_2_baseos']},\n {'reference':'libxml2-devel-2.9.7-7.el8', 'cpu':'s390x', 'release':'8', 'el_string':'el8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'rhel_eus_8_2_appstream', 'rhel_eus_8_2_baseos']},\n {'reference':'libxml2-devel-2.9.7-7.el8', 'cpu':'x86_64', 'release':'8', 'el_string':'el8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'rhel_eus_8_2_appstream', 'rhel_eus_8_2_baseos']},\n {'reference':'python3-libxml2-2.9.7-7.el8', 'cpu':'aarch64', 'release':'8', 'el_string':'el8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'rhel_eus_8_2_appstream', 'rhel_eus_8_2_baseos']},\n {'reference':'python3-libxml2-2.9.7-7.el8', 'cpu':'s390x', 'release':'8', 'el_string':'el8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'rhel_eus_8_2_appstream', 'rhel_eus_8_2_baseos']},\n {'reference':'python3-libxml2-2.9.7-7.el8', 'cpu':'x86_64', 'release':'8', 'el_string':'el8', 'rpm_spec_vers_cmp':TRUE, 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'rhel_eus_8_2_appstream', 'rhel_eus_8_2_baseos']}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n epoch = NULL;\n allowmaj = NULL;\n repo_list = NULL;\n if (!empty_or_null(package_array['repo_list'])) repo_list = package_array['repo_list'];\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'RHEL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && release) {\n repocheck = FALSE;\n if (empty_or_null(found_repos))\n {\n repocheck = TRUE;\n }\n else\n {\n foreach repo (repo_list) {\n if (contains_element(var:found_repos, value:repo))\n {\n repocheck = TRUE;\n break;\n }\n }\n }\n if (repocheck && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n if (empty_or_null(host_repo_list)) extra = rpm_report_get() + redhat_report_repo_caveat();\n else extra = rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libxml2 / libxml2-debugsource / libxml2-devel / python3-libxml2');\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-08-14T09:02:36", "description": "A NULL pointer dereference vulnerability exists in the\nxpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when\nparsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR\ncase. Applications processing untrusted XSL format inputs with the use\nof the libxml2 library may be vulnerable to a denial of service attack\ndue to a crash of the application. A NULL pointer dereference\nvulnerability exists in the xpath.c:xmlXPathCompOpEval() function of\nlibxml2 when parsing invalid XPath expression. Applications processing\nuntrusted XSL format inputs with the use of libxml2 library may be\nvulnerable to denial of service attack due to crash of the\napplication. (CVE-2018-14404)\n\nUse after free in libxml2 before 2.9.5, as used in Google Chrome prior\nto 63.0.3239.84 and other products, allowed a remote attacker to\npotentially exploit heap corruption via a crafted HTML page. A\nuse-after-free flaw was found in the libxml2 library. An attacker\ncould use this flaw to cause an application linked against libxml2 to\ncrash when parsing a specially crafted XML file. (CVE-2017-15412)\n\nThe xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly\ndetect compression errors, which allows context-dependent attackers to\ncause a denial of service (process hang) via crafted XML data. A\ndenial of service flaw was found in libxml2. A remote attacker could\nprovide a specially crafted XML or HTML file that, when processed by\nan application using libxml2, would cause that application to crash.\n(CVE-2015-8035)\n\nlibxml2 2.9.8, if --with-lzma is used, allows remote attackers to\ncause a denial of service (infinite loop) via a crafted XML file that\ntriggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different\nvulnerability than CVE-2015-8035 and CVE-2018-9251 . (CVE-2018-14567)\n\nThe xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote\nattackers to cause a denial of service (memory consumption) via a\ncrafted LZMA file, because the decoder functionality does not restrict\nmemory usage to what is required for a legitimate file.\n(CVE-2017-18258)\n\nUse-after-free vulnerability in libxml2 through 2.9.4, as used in\nGoogle Chrome before 52.0.2743.82, allows remote attackers to cause a\ndenial of service or possibly have unspecified other impact via\nvectors related to the XPointer range-to function. (CVE-2016-5131)", "edition": 1, "cvss3": {"score": 8.8, "vector": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2020-08-13T00:00:00", "title": "Amazon Linux AMI : libxml2 (ALAS-2020-1415)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14404", "CVE-2018-14567", "CVE-2018-9251", "CVE-2017-15412", "CVE-2016-5131", "CVE-2017-18258", "CVE-2015-8035"], "modified": "2020-08-13T00:00:00", "cpe": ["p-cpe:/a:amazon:linux:libxml2-devel", "p-cpe:/a:amazon:linux:libxml2", "p-cpe:/a:amazon:linux:libxml2-python27", "p-cpe:/a:amazon:linux:libxml2-debuginfo", "p-cpe:/a:amazon:linux:libxml2-python26", "p-cpe:/a:amazon:linux:libxml2-static", "cpe:/o:amazon:linux"], "id": "ALA_ALAS-2020-1415.NASL", "href": "https://www.tenable.com/plugins/nessus/139549", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Amazon Linux AMI Security Advisory ALAS-2020-1415.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(139549);\n script_version(\"1.1\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/08/13\");\n\n script_cve_id(\"CVE-2015-8035\", \"CVE-2016-5131\", \"CVE-2017-15412\", \"CVE-2017-18258\", \"CVE-2018-14404\", \"CVE-2018-14567\");\n script_xref(name:\"ALAS\", value:\"2020-1415\");\n\n script_name(english:\"Amazon Linux AMI : libxml2 (ALAS-2020-1415)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote Amazon Linux AMI host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"A NULL pointer dereference vulnerability exists in the\nxpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when\nparsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR\ncase. Applications processing untrusted XSL format inputs with the use\nof the libxml2 library may be vulnerable to a denial of service attack\ndue to a crash of the application. A NULL pointer dereference\nvulnerability exists in the xpath.c:xmlXPathCompOpEval() function of\nlibxml2 when parsing invalid XPath expression. Applications processing\nuntrusted XSL format inputs with the use of libxml2 library may be\nvulnerable to denial of service attack due to crash of the\napplication. (CVE-2018-14404)\n\nUse after free in libxml2 before 2.9.5, as used in Google Chrome prior\nto 63.0.3239.84 and other products, allowed a remote attacker to\npotentially exploit heap corruption via a crafted HTML page. A\nuse-after-free flaw was found in the libxml2 library. An attacker\ncould use this flaw to cause an application linked against libxml2 to\ncrash when parsing a specially crafted XML file. (CVE-2017-15412)\n\nThe xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly\ndetect compression errors, which allows context-dependent attackers to\ncause a denial of service (process hang) via crafted XML data. A\ndenial of service flaw was found in libxml2. A remote attacker could\nprovide a specially crafted XML or HTML file that, when processed by\nan application using libxml2, would cause that application to crash.\n(CVE-2015-8035)\n\nlibxml2 2.9.8, if --with-lzma is used, allows remote attackers to\ncause a denial of service (infinite loop) via a crafted XML file that\ntriggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different\nvulnerability than CVE-2015-8035 and CVE-2018-9251 . (CVE-2018-14567)\n\nThe xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote\nattackers to cause a denial of service (memory consumption) via a\ncrafted LZMA file, because the decoder functionality does not restrict\nmemory usage to what is required for a legitimate file.\n(CVE-2017-18258)\n\nUse-after-free vulnerability in libxml2 through 2.9.4, as used in\nGoogle Chrome before 52.0.2743.82, allows remote attackers to cause a\ndenial of service or possibly have unspecified other impact via\nvectors related to the XPointer range-to function. (CVE-2016-5131)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://alas.aws.amazon.com/ALAS-2020-1415.html\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\"Run 'yum update libxml2' to update your system.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:libxml2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:libxml2-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:libxml2-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:libxml2-python26\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:libxml2-python27\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:libxml2-static\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:amazon:linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/11/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/08/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/08/13\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Amazon Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/AmazonLinux/release\", \"Host/AmazonLinux/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/AmazonLinux/release\");\nif (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, \"Amazon Linux\");\nos_ver = pregmatch(pattern: \"^AL(A|\\d)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Amazon Linux\");\nos_ver = os_ver[1];\nif (os_ver != \"A\")\n{\n if (os_ver == 'A') os_ver = 'AMI';\n audit(AUDIT_OS_NOT, \"Amazon Linux AMI\", \"Amazon Linux \" + os_ver);\n}\n\nif (!get_kb_item(\"Host/AmazonLinux/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (rpm_check(release:\"ALA\", reference:\"libxml2-2.9.1-6.4.40.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"libxml2-debuginfo-2.9.1-6.4.40.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"libxml2-devel-2.9.1-6.4.40.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"libxml2-python26-2.9.1-6.4.40.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"libxml2-python27-2.9.1-6.4.40.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"libxml2-static-2.9.1-6.4.40.amzn1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libxml2 / libxml2-debuginfo / libxml2-devel / libxml2-python26 / etc\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "openvas": [{"lastseen": "2020-01-31T17:39:24", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14404", "CVE-2018-14567", "CVE-2018-9251"], "description": "The remote host is missing an update for the ", "modified": "2020-01-31T00:00:00", "published": "2018-10-26T00:00:00", "id": "OPENVAS:1361412562310852042", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310852042", "type": "openvas", "title": "openSUSE: Security Advisory for libxml2 (openSUSE-SU-2018:3110-1)", "sourceData": "# Copyright (C) 2018 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of their respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.852042\");\n script_version(\"2020-01-31T08:23:39+0000\");\n script_cve_id(\"CVE-2018-14404\", \"CVE-2018-14567\", \"CVE-2018-9251\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:23:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2018-10-26 06:37:10 +0200 (Fri, 26 Oct 2018)\");\n script_name(\"openSUSE: Security Advisory for libxml2 (openSUSE-SU-2018:3110-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap15\\.0\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2018:3110-1\");\n script_xref(name:\"URL\", value:\"https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00029.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'libxml2'\n package(s) announced via the openSUSE-SU-2018:3110-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"This update for libxml2 fixes the following security issues:\n\n - CVE-2018-9251: The xz_decomp function allowed remote attackers to cause\n a denial of service (infinite loop) via a crafted XML file that triggers\n LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint (bsc#1088279)\n\n - CVE-2018-14567: Prevent denial of service (infinite loop) via a crafted\n XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n (bsc#1105166)\n\n - CVE-2018-14404: Prevent NULL pointer dereference in the\n xmlXPathCompOpEval() function when parsing an invalid XPath expression\n in the XPATH_OP_AND or XPATH_OP_OR case leading to a denial of service\n attack (bsc#1102046)\n\n This update was imported from the SUSE:SLE-15:Update update project.\n\n Patch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended\n installation methods\n like YaST online_update or 'zypper patch'.\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 15.0:\n\n zypper in -t patch openSUSE-2018-1150=1\");\n\n script_tag(name:\"affected\", value:\"libxml2 on openSUSE Leap 15.0.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSELeap15.0\") {\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-2\", rpm:\"libxml2-2~2.9.7~lp150.2.3.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-2-debuginfo\", rpm:\"libxml2-2-debuginfo~2.9.7~lp150.2.3.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-debugsource\", rpm:\"libxml2-debugsource~2.9.7~lp150.2.3.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-devel\", rpm:\"libxml2-devel~2.9.7~lp150.2.3.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-tools\", rpm:\"libxml2-tools~2.9.7~lp150.2.3.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-tools-debuginfo\", rpm:\"libxml2-tools-debuginfo~2.9.7~lp150.2.3.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"python-libxml2-python-debugsource\", rpm:\"python-libxml2-python-debugsource~2.9.7~lp150.2.3.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"python2-libxml2-python\", rpm:\"python2-libxml2-python~2.9.7~lp150.2.3.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"python2-libxml2-python-debuginfo\", rpm:\"python2-libxml2-python-debuginfo~2.9.7~lp150.2.3.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"python3-libxml2-python\", rpm:\"python3-libxml2-python~2.9.7~lp150.2.3.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"python3-libxml2-python-debuginfo\", rpm:\"python3-libxml2-python-debuginfo~2.9.7~lp150.2.3.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-doc\", rpm:\"libxml2-doc~2.9.7~lp150.2.3.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-2-32bit\", rpm:\"libxml2-2-32bit~2.9.7~lp150.2.3.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-2-32bit-debuginfo\", rpm:\"libxml2-2-32bit-debuginfo~2.9.7~lp150.2.3.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-devel-32bit\", rpm:\"libxml2-devel-32bit~2.9.7~lp150.2.3.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-01-31T17:39:52", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14404", "CVE-2018-14567", "CVE-2018-9251", "CVE-2017-18258"], "description": "The remote host is missing an update for the ", "modified": "2020-01-31T00:00:00", "published": "2018-10-13T00:00:00", "id": "OPENVAS:1361412562310851931", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851931", "type": "openvas", "title": "openSUSE: Security Advisory for libxml2 (openSUSE-SU-2018:3107-1)", "sourceData": "# Copyright (C) 2018 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of their respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.851931\");\n script_version(\"2020-01-31T08:23:39+0000\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:23:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2018-10-13 06:53:40 +0200 (Sat, 13 Oct 2018)\");\n script_cve_id(\"CVE-2017-18258\", \"CVE-2018-14404\", \"CVE-2018-14567\", \"CVE-2018-9251\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"openSUSE: Security Advisory for libxml2 (openSUSE-SU-2018:3107-1)\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'libxml2'\n package(s) announced via the referenced advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"This update for libxml2 fixes the following security issues:\n\n - CVE-2018-9251: The xz_decomp function allowed remote attackers to cause\n a denial of service (infinite loop) via a crafted XML file that triggers\n LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint (bsc#1088279).\n\n - CVE-2018-14567: Prevent denial of service (infinite loop) via a crafted\n XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n (bsc#1105166).\n\n - CVE-2018-14404: Prevent NULL pointer dereference in the\n xmlXPathCompOpEval() function when parsing an invalid XPath expression\n in the XPATH_OP_AND or XPATH_OP_OR case leading to a denial of service\n attack (bsc#1102046).\n\n - CVE-2017-18258: The xz_head function allowed remote attackers to cause a\n denial of service (memory consumption) via a crafted LZMA file, because\n the decoder functionality did not restrict memory usage to what is\n required for a legitimate file (bsc#1088601).\n\n This update was imported from the SUSE:SLE-12-SP2:Update update project.\n\n Patch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended\n installation methods\n like YaST online_update or 'zypper patch'.\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 42.3:\n\n zypper in -t patch openSUSE-2018-1149=1\");\n\n script_tag(name:\"affected\", value:\"libxml2 on openSUSE Leap 42.3\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2018:3107-1\");\n script_xref(name:\"URL\", value:\"https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00026.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap42\\.3\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSELeap42.3\") {\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-2\", rpm:\"libxml2-2~2.9.4~18.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-2-debuginfo\", rpm:\"libxml2-2-debuginfo~2.9.4~18.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-debugsource\", rpm:\"libxml2-debugsource~2.9.4~18.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-devel\", rpm:\"libxml2-devel~2.9.4~18.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-tools\", rpm:\"libxml2-tools~2.9.4~18.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-tools-debuginfo\", rpm:\"libxml2-tools-debuginfo~2.9.4~18.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"python-libxml2\", rpm:\"python-libxml2~2.9.4~18.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"python-libxml2-debuginfo\", rpm:\"python-libxml2-debuginfo~2.9.4~18.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"python-libxml2-debugsource\", rpm:\"python-libxml2-debugsource~2.9.4~18.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-2-32bit\", rpm:\"libxml2-2-32bit~2.9.4~18.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-2-debuginfo-32bit\", rpm:\"libxml2-2-debuginfo-32bit~2.9.4~18.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-devel-32bit\", rpm:\"libxml2-devel-32bit~2.9.4~18.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-doc\", rpm:\"libxml2-doc~2.9.4~18.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-01-29T20:06:50", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14404", "CVE-2018-14567", "CVE-2018-9251", "CVE-2017-18258"], "description": "CVE-2018-14404\nFix of a NULL pointer dereference which might result in a crash and\nthus in a denial of service.\n\nCVE-2018-14567 and CVE-2018-9251\nApproval in LZMA error handling which prevents an infinite loop.\n\nCVE-2017-18258\nLimit available memory to 100MB to avoid exhaustive memory\nconsumption by malicious files.", "modified": "2020-01-29T00:00:00", "published": "2018-09-28T00:00:00", "id": "OPENVAS:1361412562310891524", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310891524", "type": "openvas", "title": "Debian LTS: Security Advisory for libxml2 (DLA-1524-1)", "sourceData": "# Copyright (C) 2018 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.891524\");\n script_version(\"2020-01-29T08:22:52+0000\");\n script_cve_id(\"CVE-2017-18258\", \"CVE-2018-14404\", \"CVE-2018-14567\", \"CVE-2018-9251\");\n script_name(\"Debian LTS: Security Advisory for libxml2 (DLA-1524-1)\");\n script_tag(name:\"last_modification\", value:\"2020-01-29 08:22:52 +0000 (Wed, 29 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2018-09-28 00:00:00 +0200 (Fri, 28 Sep 2018)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB8\");\n\n script_tag(name:\"affected\", value:\"libxml2 on Debian Linux\");\n\n script_tag(name:\"solution\", value:\"For Debian 8 'Jessie', these problems have been fixed in version\n2.9.1+dfsg1-5+deb8u7.\n\nWe recommend that you upgrade your libxml2 packages.\");\n\n script_tag(name:\"summary\", value:\"CVE-2018-14404\nFix of a NULL pointer dereference which might result in a crash and\nthus in a denial of service.\n\nCVE-2018-14567 and CVE-2018-9251\nApproval in LZMA error handling which prevents an infinite loop.\n\nCVE-2017-18258\nLimit available memory to 100MB to avoid exhaustive memory\nconsumption by malicious files.\");\n\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"libxml2\", ver:\"2.9.1+dfsg1-5+deb8u7\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libxml2-dbg\", ver:\"2.9.1+dfsg1-5+deb8u7\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libxml2-dev\", ver:\"2.9.1+dfsg1-5+deb8u7\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libxml2-doc\", ver:\"2.9.1+dfsg1-5+deb8u7\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libxml2-utils\", ver:\"2.9.1+dfsg1-5+deb8u7\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libxml2-utils-dbg\", ver:\"2.9.1+dfsg1-5+deb8u7\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"python-libxml2\", ver:\"2.9.1+dfsg1-5+deb8u7\", rls:\"DEB8\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"python-libxml2-dbg\", ver:\"2.9.1+dfsg1-5+deb8u7\", rls:\"DEB8\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-05-29T18:32:54", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14404", "CVE-2018-9251"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2018-08-07T00:00:00", "id": "OPENVAS:1361412562310874903", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310874903", "type": "openvas", "title": "Fedora Update for libxml2 FEDORA-2018-3b782350ff", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2018_3b782350ff_libxml2_fc28.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for libxml2 FEDORA-2018-3b782350ff\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.874903\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-08-07 06:05:24 +0200 (Tue, 07 Aug 2018)\");\n script_cve_id(\"CVE-2018-14404\", \"CVE-2018-9251\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for libxml2 FEDORA-2018-3b782350ff\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'libxml2'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is\npresent on the target host.\");\n script_tag(name:\"affected\", value:\"libxml2 on Fedora 28\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n\n script_xref(name:\"FEDORA\", value:\"2018-3b782350ff\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G5AFZARX7BUSU24J2MJ4AHX5OE47UXQA\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC28\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC28\")\n{\n\n if ((res = isrpmvuln(pkg:\"libxml2\", rpm:\"libxml2~2.9.8~4.fc28\", rls:\"FC28\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-05-29T18:33:06", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14404", "CVE-2018-9251"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2018-08-10T00:00:00", "id": "OPENVAS:1361412562310874921", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310874921", "type": "openvas", "title": "Fedora Update for libxml2 FEDORA-2018-e198cf4a64", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2018_e198cf4a64_libxml2_fc27.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for libxml2 FEDORA-2018-e198cf4a64\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.874921\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-08-10 06:27:09 +0200 (Fri, 10 Aug 2018)\");\n script_cve_id(\"CVE-2018-14404\", \"CVE-2018-9251\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for libxml2 FEDORA-2018-e198cf4a64\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'libxml2'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"libxml2 on Fedora 27\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n\n script_xref(name:\"FEDORA\", value:\"2018-e198cf4a64\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5AFXFHKUDFZEHTMUDJLFYGVCUAZKGKC7\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC27\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC27\")\n{\n\n if ((res = isrpmvuln(pkg:\"libxml2\", rpm:\"libxml2~2.9.8~4.fc27\", rls:\"FC27\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-01-27T18:37:38", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14404", "CVE-2018-14567", "CVE-2017-5969", "CVE-2017-9049", "CVE-2017-8872", "CVE-2018-9251", "CVE-2017-9048", "CVE-2017-18258", "CVE-2015-8035"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220192626", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220192626", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for libxml2 (EulerOS-SA-2019-2626)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2019.2626\");\n script_version(\"2020-01-23T13:10:04+0000\");\n script_cve_id(\"CVE-2015-8035\", \"CVE-2017-18258\", \"CVE-2017-5969\", \"CVE-2017-8872\", \"CVE-2017-9048\", \"CVE-2017-9049\", \"CVE-2018-14404\", \"CVE-2018-14567\");\n script_tag(name:\"cvss_base\", value:\"6.4\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 13:10:04 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 13:10:04 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for libxml2 (EulerOS-SA-2019-2626)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROS-2\\.0SP3\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2019-2626\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-2626\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'libxml2' package(s) announced via the EulerOS-SA-2019-2626 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"** DISPUTED ** libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document. NOTE: The maintainer states 'I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser.'(CVE-2017-5969)\n\nA NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.(CVE-2018-14404)\n\nlibxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.(CVE-2018-14567)\n\nlibxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.(CVE-2017-9049)\n\nlibxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 size. This vulnerability causes programs that use libxml2, such as PHP, to crash.(CVE-2017-9048)\n\nThe htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.(CVE-2017-8872)\n\nThe xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.(CVE-2015-8035)\n\nThe xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.(CVE-2017-18258)\");\n\n script_tag(name:\"affected\", value:\"'libxml2' package(s) on Huawei EulerOS V2.0SP3.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROS-2.0SP3\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2\", rpm:\"libxml2~2.9.1~6.3.h17\", rls:\"EULEROS-2.0SP3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-devel\", rpm:\"libxml2-devel~2.9.1~6.3.h17\", rls:\"EULEROS-2.0SP3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-python\", rpm:\"libxml2-python~2.9.1~6.3.h17\", rls:\"EULEROS-2.0SP3\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P"}}, {"lastseen": "2019-05-29T18:33:23", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14404", "CVE-2018-14567", "CVE-2016-9318", "CVE-2017-18258", "CVE-2017-16932"], "description": "The remote host is missing an update for the ", "modified": "2019-03-18T00:00:00", "published": "2018-10-26T00:00:00", "id": "OPENVAS:1361412562310843738", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310843738", "type": "openvas", "title": "Ubuntu Update for libxml2 USN-3739-1", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ubuntu_USN_3739_1.nasl 14288 2019-03-18 16:34:17Z cfischer $\n#\n# Ubuntu Update for libxml2 USN-3739-1\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.843738\");\n script_version(\"$Revision: 14288 $\");\n script_cve_id(\"CVE-2016-9318\", \"CVE-2017-16932\", \"CVE-2017-18258\", \"CVE-2018-14404\", \"CVE-2018-14567\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 17:34:17 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-10-26 06:13:35 +0200 (Fri, 26 Oct 2018)\");\n script_name(\"Ubuntu Update for libxml2 USN-3739-1\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU(14\\.04 LTS|18\\.04 LTS|16\\.04 LTS)\");\n\n script_xref(name:\"USN\", value:\"3739-1\");\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-3739-1/\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'libxml2'\n package(s) announced via the USN-3739-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Matias Brutti discovered that libxml2 incorrectly handled certain XML\nfiles. An attacker could possibly use this issue to expose sensitive\ninformation. (CVE-2016-9318)\n\nIt was discovered that libxml2 incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a denial of service.\nThis issue only affected Ubuntu 18.04 LTS. (CVE-2017-16932)\n\nIt was discovered that libxml2 incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2017-18258, CVE-2018-14404, CVE-2018-14567)\");\n\n script_tag(name:\"affected\", value:\"libxml2 on Ubuntu 18.04 LTS,\n Ubuntu 16.04 LTS,\n Ubuntu 14.04 LTS.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"UBUNTU14.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libxml2\", ver:\"2.9.1+dfsg1-3ubuntu4.13\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libxml2-utils\", ver:\"2.9.1+dfsg1-3ubuntu4.13\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"python-libxml2\", ver:\"2.9.1+dfsg1-3ubuntu4.13\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU18.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libxml2\", ver:\"2.9.4+dfsg1-6.1ubuntu1.2\", rls:\"UBUNTU18.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libxml2-utils\", ver:\"2.9.4+dfsg1-6.1ubuntu1.2\", rls:\"UBUNTU18.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"python-libxml2\", ver:\"2.9.4+dfsg1-6.1ubuntu1.2\", rls:\"UBUNTU18.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"python3-libxml2\", ver:\"2.9.4+dfsg1-6.1ubuntu1.2\", rls:\"UBUNTU18.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU16.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libxml2\", ver:\"2.9.3+dfsg1-1ubuntu0.6\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libxml2-utils\", ver:\"2.9.3+dfsg1-1ubuntu0.6\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"python-libxml2\", ver:\"2.9.3+dfsg1-1ubuntu0.6\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-01-27T18:39:13", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14404"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220191315", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220191315", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for libxml2 (EulerOS-SA-2019-1315)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2019.1315\");\n script_version(\"2020-01-23T11:39:11+0000\");\n script_cve_id(\"CVE-2018-14404\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 11:39:11 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 11:39:11 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for libxml2 (EulerOS-SA-2019-1315)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROS-2\\.0SP2\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2019-1315\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1315\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'libxml2' package(s) announced via the EulerOS-SA-2019-1315 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"A null pointer dereference vulnerability exists in the xpath function of libxml2 when parsing invalid XPath expression. Applications processing untrusted XSL format inputs with the use of libxml2 library may be vulnerable to denial of service attack due to crash of the application.(CVE-2018-14404)\");\n\n script_tag(name:\"affected\", value:\"'libxml2' package(s) on Huawei EulerOS V2.0SP2.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROS-2.0SP2\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2\", rpm:\"libxml2~2.9.1~6.3.h12\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-devel\", rpm:\"libxml2-devel~2.9.1~6.3.h12\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-python\", rpm:\"libxml2-python~2.9.1~6.3.h12\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-03-23T14:57:09", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14567", "CVE-2017-9049", "CVE-2017-8872", "CVE-2018-9251", "CVE-2017-9048", "CVE-2016-1839", "CVE-2015-8035", "CVE-2017-9050"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-03-19T00:00:00", "published": "2020-03-19T00:00:00", "id": "OPENVAS:1361412562311220201268", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220201268", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for libxml2 (EulerOS-SA-2020-1268)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2020.1268\");\n script_version(\"2020-03-19T13:43:01+0000\");\n script_cve_id(\"CVE-2017-8872\", \"CVE-2017-9048\", \"CVE-2017-9049\", \"CVE-2017-9050\", \"CVE-2018-14567\", \"CVE-2018-9251\");\n script_tag(name:\"cvss_base\", value:\"6.4\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-03-19 13:43:01 +0000 (Thu, 19 Mar 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-03-19 13:43:01 +0000 (Thu, 19 Mar 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for libxml2 (EulerOS-SA-2020-1268)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROSVIRT-3\\.0\\.2\\.2\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2020-1268\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1268\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'libxml2' package(s) announced via the EulerOS-SA-2020-1268 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.(CVE-2017-9050)\n\nlibxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.(CVE-2017-9049)\n\nlibxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 size. This vulnerability causes programs that use libxml2, such as PHP, to crash.(CVE-2017-9048)\n\nThe htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.(CVE-2017-8872)\n\nThe xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.(CVE-2018-9251)\n\nlibxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.(CVE-2018-14567)\");\n\n script_tag(name:\"affected\", value:\"'libxml2' package(s) on Huawei EulerOS Virtualization 3.0.2.2.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROSVIRT-3.0.2.2\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2\", rpm:\"libxml2~2.9.1~6.3.h17\", rls:\"EULEROSVIRT-3.0.2.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-devel\", rpm:\"libxml2-devel~2.9.1~6.3.h17\", rls:\"EULEROSVIRT-3.0.2.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-python\", rpm:\"libxml2-python~2.9.1~6.3.h17\", rls:\"EULEROSVIRT-3.0.2.2\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P"}}, {"lastseen": "2020-01-27T18:40:37", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-14567", "CVE-2017-5969", "CVE-2017-8872", "CVE-2018-9251", "CVE-2017-9048", "CVE-2017-0663", "CVE-2017-18258", "CVE-2015-8035"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220192491", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220192491", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for libxml2 (EulerOS-SA-2019-2491)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2019.2491\");\n script_version(\"2020-01-23T13:01:26+0000\");\n script_cve_id(\"CVE-2015-8035\", \"CVE-2017-0663\", \"CVE-2017-18258\", \"CVE-2017-5969\", \"CVE-2017-8872\", \"CVE-2017-9048\", \"CVE-2018-14567\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 13:01:26 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 13:01:26 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for libxml2 (EulerOS-SA-2019-2491)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROS-2\\.0SP2\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2019-2491\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-2491\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'libxml2' package(s) announced via the EulerOS-SA-2019-2491 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170.(CVE-2017-0663)\n\nlibxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.(CVE-2018-14567)\n\nThe htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.(CVE-2017-8872)\n\nlibxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 size. This vulnerability causes programs that use libxml2, such as PHP, to crash.(CVE-2017-9048)\n\nThe xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.(CVE-2015-8035)\n\nThe xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.(CVE-2017-18258)\n\n** DISPUTED ** libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document. NOTE: The maintainer states 'I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser.'(CVE-2017-5969)\");\n\n script_tag(name:\"affected\", value:\"'libxml2' package(s) on Huawei EulerOS V2.0SP2.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROS-2.0SP2\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2\", rpm:\"libxml2~2.9.1~6.3.h18\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-devel\", rpm:\"libxml2-devel~2.9.1~6.3.h18\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libxml2-python\", rpm:\"libxml2-python~2.9.1~6.3.h18\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "debian": [{"lastseen": "2020-08-12T01:05:15", "bulletinFamily": "unix", "cvelist": ["CVE-2018-14404", "CVE-2018-14567", "CVE-2018-9251", "CVE-2017-18258"], "description": "Package : libxml2\nVersion : 2.9.1+dfsg1-5+deb8u7\nCVE ID : CVE-2017-18258 CVE-2018-9251 CVE-2018-14404\n CVE-2018-14567\n\n\nCVE-2018-14404\n Fix of a NULL pointer dereference which might result in a crash and\n thus in a denial of service.\n\nCVE-2018-14567 and CVE-2018-9251\n Approvement in LZMA error handling which prevents an infinite loop.\n\nCVE-2017-18258\n Limit available memory to 100MB to avoid exhaustive memory\n consumption by malicious files.\n\n\nFor Debian 8 "Jessie", these problems have been fixed in version\n2.9.1+dfsg1-5+deb8u7.\n\nWe recommend that you upgrade your libxml2 packages.\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://wiki.debian.org/LTS\n", "edition": 10, "modified": "2018-09-27T20:05:41", "published": "2018-09-27T20:05:41", "id": "DEBIAN:DLA-1524-1:818AD", "href": "https://lists.debian.org/debian-lts-announce/2018/debian-lts-announce-201809/msg00035.html", "title": "[SECURITY] [DLA 1524-1] libxml2 security update", "type": "debian", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-09-22T13:00:24", "bulletinFamily": "unix", "cvelist": ["CVE-2018-14404", "CVE-2019-20388", "CVE-2018-14567", "CVE-2017-8872", "CVE-2020-7595", "CVE-2019-19956", "CVE-2017-18258", "CVE-2020-24977"], "description": "- -------------------------------------------------------------------------\nDebian LTS Advisory DLA-2369-1 debian-lts@lists.debian.org\nhttps://www.debian.org/lts/security/ Markus Koschany\nSeptember 09, 2020 https://wiki.debian.org/LTS\n- -------------------------------------------------------------------------\n\nPackage : libxml2\nVersion : 2.9.4+dfsg1-2.2+deb9u3\nCVE ID : CVE-2017-8872 CVE-2017-18258 CVE-2018-14404\n CVE-2018-14567 CVE-2019-19956 CVE-2019-20388\n CVE-2020-7595 CVE-2020-24977\nDebian Bug : 895245 862450 949583 969529 949582\n\nSeveral security vulnerabilities were corrected in libxml2, the GNOME\nXML library.\n\nCVE-2017-8872\n\n Global buffer-overflow in the htmlParseTryOrFinish function.\n\nCVE-2017-18258\n\n The xz_head function in libxml2 allows remote attackers to cause a\n denial of service (memory consumption) via a crafted LZMA file,\n because the decoder functionality does not restrict memory usage to\n what is required for a legitimate file.\n\nCVE-2018-14404\n\n A NULL pointer dereference vulnerability exists in the\n xpath.c:xmlXPathCompOpEval() function of libxml2 when parsing an\n invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case.\n Applications processing untrusted XSL format inputs may be\n vulnerable to a denial of service attack.\n\nCVE-2018-14567\n\n If the option --with-lzma is used, allows remote attackers to cause\n a denial of service (infinite loop) via a crafted XML file.\n\nCVE-2019-19956\n\n The xmlParseBalancedChunkMemoryRecover function has a memory leak\n related to newDoc->oldNs.\n\nCVE-2019-20388\n\n A memory leak was found in the xmlSchemaValidateStream function of\n libxml2. Applications that use this library may be vulnerable to\n memory not being freed leading to a denial of service.\n\nCVE-2020-7595\n\n Infinite loop in xmlStringLenDecodeEntities can cause a denial of\n service.\n\nCVE-2020-24977\n\n Out-of-bounds read restricted to xmllint --htmlout.\n\nFor Debian 9 stretch, these problems have been fixed in version\n2.9.4+dfsg1-2.2+deb9u3.\n\nWe recommend that you upgrade your libxml2 packages.\n\nFor the detailed security status of libxml2 please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/libxml2\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://wiki.debian.org/LTS\n", "edition": 3, "modified": "2020-09-09T22:42:05", "published": "2020-09-09T22:42:05", "id": "DEBIAN:DLA-2369-1:E14AE", "href": "https://lists.debian.org/debian-lts-announce/2020/debian-lts-announce-202009/msg00009.html", "title": "[SECURITY] [DLA 2369-1] libxml2 security update", "type": "debian", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P"}}], "suse": [{"lastseen": "2018-10-12T14:30:05", "bulletinFamily": "unix", "cvelist": ["CVE-2018-14404", "CVE-2018-14567", "CVE-2018-9251", "CVE-2017-18258"], "description": "This update for libxml2 fixes the following security issues:\n\n - CVE-2018-9251: The xz_decomp function allowed remote attackers to cause\n a denial of service (infinite loop) via a crafted XML file that triggers\n LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint (bsc#1088279).\n - CVE-2018-14567: Prevent denial of service (infinite loop) via a crafted\n XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint\n (bsc#1105166).\n - CVE-2018-14404: Prevent NULL pointer dereference in the\n xmlXPathCompOpEval() function when parsing an invalid XPath expression\n in the XPATH_OP_AND or XPATH_OP_OR case leading to a denial of service\n attack (bsc#1102046).\n - CVE-2017-18258: The xz_head function allowed remote attackers to cause a\n denial of service (memory consumption) via a crafted LZMA file, because\n the decoder functionality did not restrict memory usage to what is\n required for a legitimate file (bsc#1088601).\n\n This update was imported from the SUSE:SLE-12-SP2:Update update project.\n\n", "edition": 1, "modified": "2018-10-12T12:10:07", "published": "2018-10-12T12:10:07", "id": "OPENSUSE-SU-2018:3107-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00026.html", "title": "Security update for libxml2 (moderate)", "type": "suse", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2019-02-14T20:33:13", "bulletinFamily": "unix", "cvelist": ["CVE-2018-14404", "CVE-2018-16470", "CVE-2018-16468"], "description": "This update for rmt-server to version 1.1.1 fixes the following issues:\n\n The following issues have been fixed:\n\n - Fixed migration problems which caused some extensions / modules to be\n dropped (bsc#1118584, bsc#1118579)\n - Fixed listing of mirrored products (bsc#1102193)\n - Include online migration paths into offline migration (bsc#1117106)\n - Sync products that do not have a base product (bsc#1109307)\n - Fixed SLP auto discovery for RMT (bsc#1113760)\n\n Update dependencies for security fixes:\n\n - CVE-2018-16468: Update loofah to 2.2.3 (bsc#1113969)\n - CVE-2018-16470: Update rack to 2.0.6 (bsc#1114831)\n - CVE-2018-14404: Update nokogiri to 1.8.5 (bsc#1102046)\n\n This update was imported from the SUSE:SLE-15:Update update project.\n\n", "edition": 1, "modified": "2019-02-14T18:11:22", "published": "2019-02-14T18:11:22", "id": "OPENSUSE-SU-2019:0185-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00026.html", "title": "Security update for rmt-server (moderate)", "type": "suse", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "redhat": [{"lastseen": "2020-04-30T19:35:08", "bulletinFamily": "unix", "cvelist": ["CVE-2018-14404", "CVE-2018-9251"], "description": "The libxml2 library is a development toolbox providing the implementation of various XML standards.\n\nSecurity Fix(es):\n\n* libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c (CVE-2018-14404)\n\n* libxml2: infinite loop in xz_decomp function in xzlib.c (CVE-2018-9251)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes linked from the References section.", "modified": "2020-04-28T14:47:02", "published": "2020-04-28T13:20:58", "id": "RHSA-2020:1827", "href": "https://access.redhat.com/errata/RHSA-2020:1827", "type": "redhat", "title": "(RHSA-2020:1827) Moderate: libxml2 security update", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-04-02T17:41:43", "bulletinFamily": "unix", "cvelist": ["CVE-2015-8035", "CVE-2016-5131", "CVE-2017-15412", "CVE-2017-18258", "CVE-2018-14404", "CVE-2018-14567"], "description": "The libxml2 library is a development toolbox providing the implementation of various XML standards.\n\nSecurity Fix(es):\n\n* libxml2: Use after free triggered by XPointer paths beginning with range-to (CVE-2016-5131)\n\n* libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate() function in xpath.c (CVE-2017-15412)\n\n* libxml2: DoS caused by incorrect error detection during XZ decompression (CVE-2015-8035)\n\n* libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c (CVE-2018-14404)\n\n* libxml2: Unrestricted memory usage in xz_head() function in xzlib.c (CVE-2017-18258)\n\n* libxml2: Infinite loop caused by incorrect error detection during LZMA decompression (CVE-2018-14567)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes linked from the References section.", "modified": "2020-03-31T14:09:57", "published": "2020-03-31T13:30:25", "id": "RHSA-2020:1190", "href": "https://access.redhat.com/errata/RHSA-2020:1190", "type": "redhat", "title": "(RHSA-2020:1190) Moderate: libxml2 security update", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-05-08T05:42:19", "bulletinFamily": "unix", "cvelist": ["CVE-2018-0495", "CVE-2018-0732", "CVE-2018-1000005", "CVE-2018-1000007", "CVE-2018-1000120", "CVE-2018-1000121", "CVE-2018-1000122", "CVE-2018-14404", "CVE-2018-16839", "CVE-2018-16840", "CVE-2018-16842", "CVE-2018-16890", "CVE-2019-0211", "CVE-2019-3822", "CVE-2019-3823", "CVE-2019-5436"], "description": "This release adds the new Apache HTTP Server 2.4.29 Service Pack 2 packages that are part of the JBoss Core Services offering.\n\nThis release serves as a replacement for Red Hat JBoss Core Services\nApache HTTP Server 2.4.29 SP1, and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes, enhancements and component upgrades included in this release.\n\nSecurity Fix(es):\n\n* openssl: ROHNP - Key Extraction Side Channel in Multiple Crypto Libraries (CVE-2018-0495)\n\n* openssl: Malicious server can send large prime to client during DH(E) TLS handshake causing the client to hang (CVE-2018-0732)\n\n* libxml2: NULL pointer dereference in xpath.c:xmlXPathCompOpEval() can allow attackers to cause a denial of service (CVE-2018-14404)\n\n* curl: Out-of-bounds read in code handling HTTP/2 trailers (CVE-2018-1000005)\n\n* curl: HTTP authentication leak in redirects (CVE-2018-1000007)\n\n* curl: FTP path trickery leads to NIL byte out of bounds write (CVE-2018-1000120)\n\n* curl: RTSP RTP buffer over-read (CVE-2018-1000122)\n\n* httpd: privilege escalation from modules scripts (CVE-2019-0211)\n\nDetails around these issues, including information about CVEs, severity of the issues, and CVSS scores can be found on the CVE pages listed in the References section below.", "modified": "2020-05-08T08:58:47", "published": "2019-06-18T23:07:29", "id": "RHSA-2019:1543", "href": "https://access.redhat.com/errata/RHSA-2019:1543", "type": "redhat", "title": "(RHSA-2019:1543) Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 SP2 security update", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-07-28T20:03:39", "bulletinFamily": "unix", "cvelist": ["CVE-2018-14404", "CVE-2018-18074", "CVE-2018-19519", "CVE-2018-20060", "CVE-2018-20337", "CVE-2018-20852", "CVE-2018-7263", "CVE-2018-9251", "CVE-2019-1010180", "CVE-2019-1010204", "CVE-2019-11236", "CVE-2019-11324", "CVE-2019-12447", "CVE-2019-12448", "CVE-2019-12449", "CVE-2019-13232", "CVE-2019-13752", "CVE-2019-13753", "CVE-2019-14563", "CVE-2019-14822", "CVE-2019-1547", "CVE-2019-1549", "CVE-2019-1563", "CVE-2019-15847", "CVE-2019-16056", "CVE-2019-17451", "CVE-2019-19126", "CVE-2019-19232", "CVE-2019-19807", "CVE-2019-19923", "CVE-2019-19924", "CVE-2019-19925", "CVE-2019-19959", "CVE-2019-3016", "CVE-2019-3825", "CVE-2019-5094", "CVE-2019-5436", "CVE-2019-5481", "CVE-2019-5482", "CVE-2019-8457", "CVE-2020-10749", "CVE-2020-10754", "CVE-2020-10757", "CVE-2020-10766", "CVE-2020-10767", "CVE-2020-10768", "CVE-2020-11008", "CVE-2020-11080", "CVE-2020-12049", "CVE-2020-12653", "CVE-2020-12654", "CVE-2020-12662", "CVE-2020-12663", "CVE-2020-12888", "CVE-2020-13777", "CVE-2020-14316", "CVE-2020-8616", "CVE-2020-8617"], "description": "OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.\n\nSecurity Fix(es):\n\n* kubevirt: VMIs can be used to access host files (CVE-2020-14316)\n\n* containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters (CVE-2020-10749)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nThis update also fixes several bugs and adds various enhancements.\n\nThis advisory contains the following OpenShift Virtualization 2.4.0 images:\n\nRHEL-7-CNV-2.4\n==============\nkubevirt-ssp-operator-container-v2.4.0-71\n\nRHEL-8-CNV-2.4\n==============\nvirt-cdi-controller-container-v2.4.0-29\nvirt-cdi-uploadproxy-container-v2.4.0-29\nhostpath-provisioner-container-v2.4.0-25\nvirt-cdi-operator-container-v2.4.0-29\nkubevirt-metrics-collector-container-v2.4.0-18\ncnv-containernetworking-plugins-container-v2.4.0-36\nkubevirt-kvm-info-nfd-plugin-container-v2.4.0-18\nhostpath-provisioner-operator-container-v2.4.0-31\nvirt-cdi-uploadserver-container-v2.4.0-29\nvirt-cdi-apiserver-container-v2.4.0-29\nvirt-controller-container-v2.4.0-58\nvirt-cdi-cloner-container-v2.4.0-29\nkubevirt-template-validator-container-v2.4.0-21\nvm-import-operator-container-v2.4.0-21\nkubernetes-nmstate-handler-container-v2.4.0-37\nnode-maintenance-operator-container-v2.4.0-27\nvirt-operator-container-v2.4.0-58\nkubevirt-v2v-conversion-container-v2.4.0-23\ncnv-must-gather-container-v2.4.0-73\nvirtio-win-container-v2.4.0-15\nkubevirt-cpu-node-labeller-container-v2.4.0-19\novs-cni-plugin-container-v2.4.0-37\nkubevirt-vmware-container-v2.4.0-21\nhyperconverged-cluster-operator-container-v2.4.0-70\nvirt-handler-container-v2.4.0-58\nvirt-cdi-importer-container-v2.4.0-29\nvirt-launcher-container-v2.4.0-58\nkubevirt-cpu-model-nfd-plugin-container-v2.4.0-17\nvirt-api-container-v2.4.0-58\novs-cni-marker-container-v2.4.0-38\nkubemacpool-container-v2.4.0-39\ncluster-network-addons-operator-container-v2.4.0-38\nbridge-marker-container-v2.4.0-39\nvm-import-controller-container-v2.4.0-21\nhco-bundle-registry-container-v2.3.0-497", "modified": "2020-07-28T22:06:05", "published": "2020-07-28T22:02:45", "id": "RHSA-2020:3194", "href": "https://access.redhat.com/errata/RHSA-2020:3194", "type": "redhat", "title": "(RHSA-2020:3194) Important: Container-native Virtualization security, bug fix, and enhancement update", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-10-28T02:16:36", "bulletinFamily": "unix", "cvelist": ["CVE-2013-0169", "CVE-2016-10739", "CVE-2018-14404", "CVE-2018-14498", "CVE-2018-16890", "CVE-2018-18074", "CVE-2018-18624", "CVE-2018-18751", "CVE-2018-19519", "CVE-2018-20060", "CVE-2018-20337", "CVE-2018-20483", "CVE-2018-20657", "CVE-2018-20852", "CVE-2018-9251", "CVE-2019-1010180", "CVE-2019-1010204", "CVE-2019-11070", "CVE-2019-11236", "CVE-2019-11324", "CVE-2019-11358", "CVE-2019-11459", "CVE-2019-12447", "CVE-2019-12448", "CVE-2019-12449", "CVE-2019-12450", "CVE-2019-12795", "CVE-2019-13232", "CVE-2019-13636", "CVE-2019-13752", "CVE-2019-13753", "CVE-2019-14822", "CVE-2019-14973", "CVE-2019-1547", "CVE-2019-1549", "CVE-2019-1563", "CVE-2019-15718", "CVE-2019-15847", "CVE-2019-16056", "CVE-2019-16769", "CVE-2019-17451", "CVE-2019-18408", "CVE-2019-19126", "CVE-2019-19923", "CVE-2019-19924", "CVE-2019-19925", "CVE-2019-19959", "CVE-2019-3822", "CVE-2019-3823", "CVE-2019-3825", "CVE-2019-3843", "CVE-2019-3844", "CVE-2019-5094", "CVE-2019-5436", "CVE-2019-5481", "CVE-2019-5482", "CVE-2019-5953", "CVE-2019-6237", "CVE-2019-6251", "CVE-2019-6454", "CVE-2019-6706", "CVE-2019-7146", "CVE-2019-7149", "CVE-2019-7150", "CVE-2019-7664", "CVE-2019-7665", "CVE-2019-8457", "CVE-2019-8506", "CVE-2019-8518", "CVE-2019-8523", "CVE-2019-8524", "CVE-2019-8535", "CVE-2019-8536", "CVE-2019-8544", "CVE-2019-8558", "CVE-2019-8559", "CVE-2019-8563", "CVE-2019-8571", "CVE-2019-8583", "CVE-2019-8584", "CVE-2019-8586", "CVE-2019-8587", "CVE-2019-8594", "CVE-2019-8595", "CVE-2019-8596", "CVE-2019-8597", "CVE-2019-8601", "CVE-2019-8607", "CVE-2019-8608", "CVE-2019-8609", "CVE-2019-8610", "CVE-2019-8611", "CVE-2019-8615", "CVE-2019-8619", "CVE-2019-8622", "CVE-2019-8623", "CVE-2019-8666", "CVE-2019-8671", "CVE-2019-8672", "CVE-2019-8673", "CVE-2019-8675", "CVE-2019-8676", "CVE-2019-8677", "CVE-2019-8679", "CVE-2019-8681", "CVE-2019-8686", "CVE-2019-8687", "CVE-2019-8689", "CVE-2019-8690", "CVE-2019-8696", "CVE-2019-8726", "CVE-2019-8735", "CVE-2019-8768", "CVE-2020-10531", "CVE-2020-10715", "CVE-2020-10743", "CVE-2020-11008", "CVE-2020-11022", "CVE-2020-11023", "CVE-2020-11110", "CVE-2020-12049", "CVE-2020-12052", "CVE-2020-12245", "CVE-2020-13822", "CVE-2020-14040", "CVE-2020-14336", "CVE-2020-15366", "CVE-2020-15719", "CVE-2020-1712", "CVE-2020-7013", "CVE-2020-7598", "CVE-2020-7662", "CVE-2020-8203", "CVE-2020-8559", "CVE-2020-9283"], "description": "Red Hat OpenShift Container Platform is Red Hat's cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic (CVE-2020-9283)\n\n* SSL/TLS: CBC padding timing attack (lucky-13) (CVE-2013-0169)\n\n* grafana: XSS vulnerability via a column style on the \"Dashboard > Table Panel\" screen (CVE-2018-18624)\n\n* js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection (CVE-2019-11358)\n\n* npm-serialize-javascript: XSS via unsafe characters in serialized regular expressions (CVE-2019-16769)\n\n* kibana: Prototype pollution in TSVB could result in arbitrary code execution (ESA-2020-06) (CVE-2020-7013)\n\n* nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload (CVE-2020-7598)\n\n* npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser (CVE-2020-7662)\n\n* nodejs-lodash: prototype pollution in zipObjectDeep function (CVE-2020-8203)\n\n* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n\n* jQuery: passing HTML containing <option> elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)\n\n* grafana: stored XSS (CVE-2020-11110)\n\n* grafana: XSS annotation popup vulnerability (CVE-2020-12052)\n\n* grafana: XSS via column.title or cellLinkTooltip (CVE-2020-12245)\n\n* nodejs-elliptic: improper encoding checks allows a certain degree of signature malleability in ECDSA signatures (CVE-2020-13822)\n\n* golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash (CVE-2020-14040)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* openshift/console: text injection on error page via crafted url (CVE-2020-10715)\n\n* kibana: X-Frame-Option not set by default might lead to clickjacking (CVE-2020-10743)\n\n* openshift: restricted SCC allows pods to craft custom network packets (CVE-2020-14336)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "modified": "2020-10-28T04:36:30", "published": "2020-10-27T18:57:54", "id": "RHSA-2020:4298", "href": "https://access.redhat.com/errata/RHSA-2020:4298", "type": "redhat", "title": "(RHSA-2020:4298) Moderate: OpenShift Container Platform 4.6.1 image security update", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "oraclelinux": [{"lastseen": "2020-06-04T23:23:40", "bulletinFamily": "unix", "cvelist": ["CVE-2018-14404", "CVE-2018-9251"], "description": "[2.9.7-7.0.1]\n- Update doc/redhat.gif in tarball\n- Add libxml2-oracle-enterprise.patch and update logos in tarball\n[2.9.7-7]\n- Fix CVE-2018-14404 (#1595989)\n[2.9.7-6]\n- Fix CVE-2018-9251 (#1565322)", "edition": 1, "modified": "2020-05-05T00:00:00", "published": "2020-05-05T00:00:00", "id": "ELSA-2020-1827", "href": "http://linux.oracle.com/errata/ELSA-2020-1827.html", "title": "libxml2 security update", "type": "oraclelinux", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-04-09T02:46:57", "bulletinFamily": "unix", "cvelist": ["CVE-2018-14404", "CVE-2018-1456", "CVE-2018-14567", "CVE-2017-15412", "CVE-2016-5131", "CVE-2017-18258", "CVE-2015-8035"], "description": "[2.9.1-6.0.1.4]\n- Update doc/redhat.gif in tarball\n- Add libxml2-oracle-enterprise.patch and update logos in tarball\n[2.9.1-6.4]\n- Fix CVE-2015-8035 (#1595697)\n- Fix CVE-2018-14404 (#1602817)\n- Fix CVE-2017-15412 (#1729857)\n- Fix CVE-2016-5131 (#1714050)\n- Fix CVE-2017-18258 (#1579211)\n- Fix CVE-2018-1456 (#1622715)", "edition": 1, "modified": "2020-04-06T00:00:00", "published": "2020-04-06T00:00:00", "id": "ELSA-2020-1190", "href": "http://linux.oracle.com/errata/ELSA-2020-1190.html", "title": "libxml2 security update", "type": "oraclelinux", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "fedora": [{"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2018-14404", "CVE-2018-9251"], "description": "This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library. ", "modified": "2018-08-09T16:53:03", "published": "2018-08-09T16:53:03", "id": "FEDORA:94363633518A", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 27 Update: libxml2-2.9.8-4.fc27", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2018-14404", "CVE-2018-9251"], "description": "This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library. ", "modified": "2018-08-07T01:20:06", "published": "2018-08-07T01:20:06", "id": "FEDORA:DA47C616A923", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 28 Update: libxml2-2.9.8-4.fc28", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "amazon": [{"lastseen": "2020-11-10T12:37:43", "bulletinFamily": "unix", "cvelist": ["CVE-2018-14404", "CVE-2018-14567", "CVE-2018-9251", "CVE-2017-15412", "CVE-2016-5131", "CVE-2017-18258", "CVE-2015-8035"], "description": "**Issue Overview:**\n\nA NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application. ([CVE-2018-14404 __](<https://access.redhat.com/security/cve/CVE-2018-14404>))\n\nUse after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. ([CVE-2017-15412 __](<https://access.redhat.com/security/cve/CVE-2017-15412>))\n\nA denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash. ([CVE-2015-8035 __](<https://access.redhat.com/security/cve/CVE-2015-8035>))\n\nlibxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than [CVE-2015-8035 __](<https://access.redhat.com/security/cve/CVE-2015-8035>) and [CVE-2018-9251 __](<https://access.redhat.com/security/cve/CVE-2018-9251>). ([CVE-2018-14567 __](<https://access.redhat.com/security/cve/CVE-2018-14567>))\n\nThe xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file. ([CVE-2017-18258 __](<https://access.redhat.com/security/cve/CVE-2017-18258>))\n\nUse-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function. ([CVE-2016-5131 __](<https://access.redhat.com/security/cve/CVE-2016-5131>)) \n\n\n \n**Affected Packages:** \n\n\nlibxml2\n\n \n**Issue Correction:** \nRun _yum update libxml2_ to update your system. \n\n\n \n\n\n**New Packages:**\n \n \n aarch64: \n libxml2-2.9.1-6.amzn2.4.1.aarch64 \n libxml2-devel-2.9.1-6.amzn2.4.1.aarch64 \n libxml2-static-2.9.1-6.amzn2.4.1.aarch64 \n libxml2-python-2.9.1-6.amzn2.4.1.aarch64 \n libxml2-debuginfo-2.9.1-6.amzn2.4.1.aarch64 \n \n i686: \n libxml2-2.9.1-6.amzn2.4.1.i686 \n libxml2-devel-2.9.1-6.amzn2.4.1.i686 \n libxml2-static-2.9.1-6.amzn2.4.1.i686 \n libxml2-python-2.9.1-6.amzn2.4.1.i686 \n libxml2-debuginfo-2.9.1-6.amzn2.4.1.i686 \n \n src: \n libxml2-2.9.1-6.amzn2.4.1.src \n \n x86_64: \n libxml2-2.9.1-6.amzn2.4.1.x86_64 \n libxml2-devel-2.9.1-6.amzn2.4.1.x86_64 \n libxml2-static-2.9.1-6.amzn2.4.1.x86_64 \n libxml2-python-2.9.1-6.amzn2.4.1.x86_64 \n libxml2-debuginfo-2.9.1-6.amzn2.4.1.x86_64 \n \n \n", "edition": 1, "modified": "2020-07-21T16:34:00", "published": "2020-07-21T16:34:00", "id": "ALAS2-2020-1466", "href": "https://alas.aws.amazon.com/AL2/ALAS-2020-1466.html", "title": "Important: libxml2", "type": "amazon", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-11-10T12:37:28", "bulletinFamily": "unix", "cvelist": ["CVE-2018-14404", "CVE-2018-14567", "CVE-2018-9251", "CVE-2017-15412", "CVE-2016-5131", "CVE-2017-18258", "CVE-2015-8035"], "description": "**Issue Overview:**\n\nA NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application. A null pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 when parsing invalid XPath expression. Applications processing untrusted XSL format inputs with the use of libxml2 library may be vulnerable to denial of service attack due to crash of the application. ([CVE-2018-14404 __](<https://access.redhat.com/security/cve/CVE-2018-14404>))\n\nUse after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. A use-after-free flaw was found in the libxml2 library. An attacker could use this flaw to cause an application linked against libxml2 to crash when parsing a specially crafted XML file. ([CVE-2017-15412 __](<https://access.redhat.com/security/cve/CVE-2017-15412>))\n\nThe xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data. A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash. ([CVE-2015-8035 __](<https://access.redhat.com/security/cve/CVE-2015-8035>))\n\nlibxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than [CVE-2015-8035 __](<https://access.redhat.com/security/cve/CVE-2015-8035>) and [CVE-2018-9251 __](<https://access.redhat.com/security/cve/CVE-2018-9251>). ([CVE-2018-14567 __](<https://access.redhat.com/security/cve/CVE-2018-14567>))\n\nThe xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file. ([CVE-2017-18258 __](<https://access.redhat.com/security/cve/CVE-2017-18258>))\n\nUse-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function. ([CVE-2016-5131 __](<https://access.redhat.com/security/cve/CVE-2016-5131>)) \n\n\n \n**Affected Packages:** \n\n\nlibxml2\n\n \n**Issue Correction:** \nRun _yum update libxml2_ to update your system. \n\n\n \n\n\n**New Packages:**\n \n \n i686: \n libxml2-2.9.1-6.4.40.amzn1.i686 \n libxml2-python26-2.9.1-6.4.40.amzn1.i686 \n libxml2-devel-2.9.1-6.4.40.amzn1.i686 \n libxml2-static-2.9.1-6.4.40.amzn1.i686 \n libxml2-python27-2.9.1-6.4.40.amzn1.i686 \n libxml2-debuginfo-2.9.1-6.4.40.amzn1.i686 \n \n src: \n libxml2-2.9.1-6.4.40.amzn1.src \n \n x86_64: \n libxml2-python26-2.9.1-6.4.40.amzn1.x86_64 \n libxml2-static-2.9.1-6.4.40.amzn1.x86_64 \n libxml2-debuginfo-2.9.1-6.4.40.amzn1.x86_64 \n libxml2-2.9.1-6.4.40.amzn1.x86_64 \n libxml2-devel-2.9.1-6.4.40.amzn1.x86_64 \n libxml2-python27-2.9.1-6.4.40.amzn1.x86_64 \n \n \n", "edition": 3, "modified": "2020-08-10T22:59:00", "published": "2020-08-10T22:59:00", "id": "ALAS-2020-1415", "href": "https://alas.aws.amazon.com/ALAS-2020-1415.html", "title": "Important: libxml2", "type": "amazon", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-11-10T12:35:19", "bulletinFamily": "unix", "cvelist": ["CVE-2018-14404"], "description": "**Issue Overview:**\n\nA null pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 when parsing invalid XPath expression. Applications processing untrusted XSL format inputs with the use of libxml2 library may be vulnerable to denial of service attack due to crash of the application.([CVE-2018-14404 __](<https://access.redhat.com/security/cve/CVE-2018-14404>))\n\n \n**Affected Packages:** \n\n\nlibxml2\n\n \n**Issue Correction:** \nRun _yum update libxml2_ to update your system. \n\n\n \n\n\n**New Packages:**\n \n \n i686: \n libxml2-devel-2.9.1-6.3.52.amzn1.i686 \n libxml2-static-2.9.1-6.3.52.amzn1.i686 \n libxml2-debuginfo-2.9.1-6.3.52.amzn1.i686 \n libxml2-2.9.1-6.3.52.amzn1.i686 \n libxml2-python26-2.9.1-6.3.52.amzn1.i686 \n libxml2-python27-2.9.1-6.3.52.amzn1.i686 \n \n src: \n libxml2-2.9.1-6.3.52.amzn1.src \n \n x86_64: \n libxml2-static-2.9.1-6.3.52.amzn1.x86_64 \n libxml2-2.9.1-6.3.52.amzn1.x86_64 \n libxml2-python27-2.9.1-6.3.52.amzn1.x86_64 \n libxml2-debuginfo-2.9.1-6.3.52.amzn1.x86_64 \n libxml2-devel-2.9.1-6.3.52.amzn1.x86_64 \n libxml2-python26-2.9.1-6.3.52.amzn1.x86_64 \n \n \n", "edition": 4, "modified": "2018-09-05T19:31:00", "published": "2018-09-05T19:31:00", "id": "ALAS-2018-1072", "href": "https://alas.aws.amazon.com/ALAS-2018-1072.html", "title": "Medium: libxml2", "type": "amazon", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "ubuntu": [{"lastseen": "2021-01-01T14:42:03", "bulletinFamily": "unix", "cvelist": ["CVE-2018-14404", "CVE-2018-14567", "CVE-2016-9318", "CVE-2017-18258", "CVE-2017-16932"], "description": "Matias Brutti discovered that libxml2 incorrectly handled certain XML files. \nAn attacker could possibly use this issue to expose sensitive information. \n(CVE-2016-9318)\n\nIt was discovered that libxml2 incorrectly handled certain files. \nAn attacker could possibly use this issue to cause a denial of service. \nThis issue only affected Ubuntu 18.04 LTS. (CVE-2017-16932)\n\nIt was discovered that libxml2 incorrectly handled certain files. \nAn attacker could possibly use this issue to cause a denial of service. \n(CVE-2017-18258, CVE-2018-14404, CVE-2018-14567)", "edition": 6, "modified": "2018-08-14T00:00:00", "published": "2018-08-14T00:00:00", "id": "USN-3739-1", "href": "https://ubuntu.com/security/notices/USN-3739-1", "title": "libxml2 vulnerabilities", "type": "ubuntu", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-01-01T14:45:16", "bulletinFamily": "unix", "cvelist": ["CVE-2018-14404", "CVE-2016-9318"], "description": "USN-3739-1 fixed a vulnerability in libxml2. This update provides \nthe corresponding update for Ubuntu 12.04.\n\nOriginal advisory details:\n\nMatias Brutti discovered that libxml2 incorrectly handled certain XML files. \nAn attacker could possibly use this issue to expose sensitive information. \n(CVE-2016-9318)\n\nIt was discovered that libxml2 incorrectly handled certain files. \nAn attacker could possibly use this issue to cause a denial of service. \n(CVE-2018-14404)", "edition": 7, "modified": "2018-08-14T00:00:00", "published": "2018-08-14T00:00:00", "id": "USN-3739-2", "href": "https://ubuntu.com/security/notices/USN-3739-2", "title": "libxml2 vulnerabilities", "type": "ubuntu", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "cloudfoundry": [{"lastseen": "2021-01-01T15:27:17", "bulletinFamily": "software", "cvelist": ["CVE-2018-14404", "CVE-2018-14567", "CVE-2016-9318", "CVE-2017-18258", "CVE-2017-16932"], "description": "# \n\n# Severity\n\nMedium\n\n# Vendor\n\nCanonical Ubuntu\n\n# Versions Affected\n\n * Canonical Ubuntu 14.04\n * Canonical Ubuntu 16.04\n * Canonical Ubuntu 18.04\n\n# Description\n\nMatias Brutti discovered that libxml2 incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information. (CVE-2016-9318)\n\nIt was discovered that libxml2 incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2017-16932)\n\nIt was discovered that libxml2 incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-18258, CVE-2018-14404, CVE-2018-14567)\n\n# Affected Cloud Foundry Products and Versions\n\n_Severity is medium unless otherwise noted._\n\n * Cloud Foundry BOSH trusty-stemcells are vulnerable, including: \n * 3363.x versions prior to 3363.72\n * 3421.x versions prior to 3421.79\n * 3445.x versions prior to 3445.64\n * 3468.x versions prior to 3468.64\n * 3541.x versions prior to 3541.44\n * 3586.x versions prior to 3586.36\n * All other stemcells not listed.\n * Cloud Foundry BOSH xenial-stemcells are vulnerable, including: \n * 97.x versions prior to 97.12\n * All other stemcells not listed.\n * All versions of Cloud Foundry cflinuxfs2 prior to 1.230.0\n * All versions of Cloud Foundry cflinuxfs3 prior to 0.10.0\n\n# Mitigation\n\nOSS users are strongly encouraged to follow one of the mitigations below:\n\n * The Cloud Foundry project recommends upgrading the following BOSH trusty-stemcells: \n * Upgrade 3363.x versions to 3363.72\n * Upgrade 3421.x versions to 3421.79\n * Upgrade 3445.x versions to 3445.64\n * Upgrade 3468.x versions to 3468.64\n * Upgrade 3541.x versions to 3541.44\n * Upgrade 3586.x versions to 3586.36\n * All other stemcells should be upgraded to the latest version available on [bosh.io](<https://bosh.io/stemcells/#ubuntu-trusty>).\n * The Cloud Foundry project recommends upgrading the following BOSH xenial-stemcells: \n * Upgrade 97.x versions to 97.12\n * All other stemcells should be upgraded to the latest version available on [bosh.io](<https://bosh.io/stemcells/#ubuntu-xenial>).\n * The Cloud Foundry project recommends that Cloud Foundry deployments run with cflinuxfs2 version 1.230.0 or later.\n * The Cloud Foundry project recommends that Cloud Foundry deployments run with cflinuxfs3 version 0.10.0 or later.\n\n# References\n\n * [USN-3739-1](<https://usn.ubuntu.com/3739-1>)\n * [CVE-2016-9318](<https://people.canonical.com/~ubuntu-security/cve/CVE-2016-9318>)\n * [CVE-2017-16932](<https://people.canonical.com/~ubuntu-security/cve/CVE-2017-16932>)\n * [CVE-2017-18258](<https://people.canonical.com/~ubuntu-security/cve/CVE-2017-18258>)\n * [CVE-2018-14404](<https://people.canonical.com/~ubuntu-security/cve/CVE-2018-14404>)\n * [CVE-2018-14567](<https://people.canonical.com/~ubuntu-security/cve/CVE-2018-14567>)\n", "edition": 3, "modified": "2018-09-11T00:00:00", "published": "2018-09-11T00:00:00", "id": "CFOUNDRY:534706586AA8B2BA233C6A2A618BD6A0", "href": "https://www.cloudfoundry.org/blog/usn-3739-1/", "title": "USN-3739-1: libxml2 vulnerabilities | Cloud Foundry", "type": "cloudfoundry", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "centos": [{"lastseen": "2020-04-08T22:43:58", "bulletinFamily": "unix", "cvelist": ["CVE-2018-14404", "CVE-2018-14567", "CVE-2017-15412", "CVE-2016-5131", "CVE-2017-18258", "CVE-2015-8035"], "description": "**CentOS Errata and Security Advisory** CESA-2020:1190\n\n\nThe libxml2 library is a development toolbox providing the implementation of various XML standards.\n\nSecurity Fix(es):\n\n* libxml2: Use after free triggered by XPointer paths beginning with range-to (CVE-2016-5131)\n\n* libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate() function in xpath.c (CVE-2017-15412)\n\n* libxml2: DoS caused by incorrect error detection during XZ decompression (CVE-2015-8035)\n\n* libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c (CVE-2018-14404)\n\n* libxml2: Unrestricted memory usage in xz_head() function in xzlib.c (CVE-2017-18258)\n\n* libxml2: Infinite loop caused by incorrect error detection during LZMA decompression (CVE-2018-14567)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes linked from the References section.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-cr-announce/2020-April/012518.html\n\n**Affected packages:**\nlibxml2\nlibxml2-devel\nlibxml2-python\nlibxml2-static\n\n**Upstream details at:**\n", "edition": 1, "modified": "2020-04-08T18:42:56", "published": "2020-04-08T18:42:56", "id": "CESA-2020:1190", "href": "http://lists.centos.org/pipermail/centos-cr-announce/2020-April/012518.html", "title": "libxml2 security update", "type": "centos", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "github": [{"lastseen": "2020-03-10T23:26:05", "bulletinFamily": "software", "cvelist": ["CVE-2018-14404"], "description": "A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.", "edition": 2, "modified": "2019-07-03T21:02:06", "published": "2019-01-17T14:05:03", "id": "GHSA-6QVP-R6R3-9P7H", "href": "https://github.com/advisories/GHSA-6qvp-r6r3-9p7h", "title": "Moderate severity vulnerability that affects nokogiri", "type": "github", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "archlinux": [{"lastseen": "2020-09-22T18:36:41", "bulletinFamily": "unix", "cvelist": ["CVE-2018-9251"], "description": "Arch Linux Security Advisory ASA-201810-4\n=========================================\n\nSeverity: Medium\nDate : 2018-10-01\nCVE-ID : CVE-2018-9251\nPackage : lib32-libxml2\nType : denial of service\nRemote : Yes\nLink : https://security.archlinux.org/AVG-673\n\nSummary\n=======\n\nThe package lib32-libxml2 before version 2.9.8-4 is vulnerable to\ndenial of service.\n\nResolution\n==========\n\nUpgrade to 2.9.8-4.\n\n# pacman -Syu \"lib32-libxml2>=2.9.8-4\"\n\nThe problem has been fixed upstream but no release is available yet.\n\nWorkaround\n==========\n\nNone.\n\nDescription\n===========\n\nA security issue has been found in libxml2 <= 2.9.8 compiled with LZMA\nsupport enabled, in the xz_decomp function in xzlib.c. This flaw allows\na remote attacker to cause a denial of service via an infinite loop,\nusing a crafted XML payload that triggers LZMA_MEMLIMIT_ERROR.\n\nImpact\n======\n\nA remote attacker is able to cause a denial of service by parsing a\nspecially crafted XML payload.\n\nReferences\n==========\n\nhttps://bugzilla.gnome.org/show_bug.cgi?id=794914\nhttps://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74\nhttps://security.archlinux.org/CVE-2018-9251", "modified": "2018-10-01T00:00:00", "published": "2018-10-01T00:00:00", "id": "ASA-201810-4", "href": "https://security.archlinux.org/ASA-201810-4", "type": "archlinux", "title": "[ASA-201810-4] lib32-libxml2: denial of service", "cvss": {"score": 2.6, "vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-09-22T18:36:41", "bulletinFamily": "unix", "cvelist": ["CVE-2018-9251"], "description": "Arch Linux Security Advisory ASA-201810-3\n=========================================\n\nSeverity: Medium\nDate : 2018-10-01\nCVE-ID : CVE-2018-9251\nPackage : libxml2\nType : denial of service\nRemote : Yes\nLink : https://security.archlinux.org/AVG-672\n\nSummary\n=======\n\nThe package libxml2 before version 2.9.8-5 is vulnerable to denial of\nservice.\n\nResolution\n==========\n\nUpgrade to 2.9.8-5.\n\n# pacman -Syu \"libxml2>=2.9.8-5\"\n\nThe problem has been fixed upstream but no release is available yet.\n\nWorkaround\n==========\n\nNone.\n\nDescription\n===========\n\nA security issue has been found in libxml2 <= 2.9.8 compiled with LZMA\nsupport enabled, in the xz_decomp function in xzlib.c. This flaw allows\na remote attacker to cause a denial of service via an infinite loop,\nusing a crafted XML payload that triggers LZMA_MEMLIMIT_ERROR.\n\nImpact\n======\n\nA remote attacker is able to cause a denial of service by parsing a\nspecially crafted XML payload.\n\nReferences\n==========\n\nhttps://bugzilla.gnome.org/show_bug.cgi?id=794914\nhttps://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74\nhttps://security.archlinux.org/CVE-2018-9251", "modified": "2018-10-01T00:00:00", "published": "2018-10-01T00:00:00", "id": "ASA-201810-3", "href": "https://security.archlinux.org/ASA-201810-3", "type": "archlinux", "title": "[ASA-201810-3] libxml2: denial of service", "cvss": {"score": 2.6, "vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P"}}], "kitploit": [{"lastseen": "2020-12-08T05:23:24", "bulletinFamily": "tools", "cvelist": ["CVE-2019-6975", "CVE-2018-20346", "CVE-2019-3863", "CVE-2018-20505", "CVE-2018-14404", "CVE-2016-5385", "CVE-2019-11358", "CVE-2019-3861", "CVE-2017-7614", "CVE-2019-3823", "CVE-2018-16840", "CVE-2019-3858", "CVE-2018-14567", "CVE-2018-17456", "CVE-2017-14930", "CVE-2016-1252", "CVE-2015-5224", "CVE-2019-3462", "CVE-2018-20482", "CVE-2018-20685", "CVE-2019-3857", "CVE-2016-0634", "CVE-2018-16890", "CVE-2019-1543", "CVE-2018-3721", "CVE-2018-9251", "CVE-2018-12699", "CVE-2018-14618", "CVE-2019-6109", "CVE-2014-9939", "CVE-2019-5428", "CVE-2016-7543", "CVE-2019-9924", "CVE-2016-9401", "CVE-2011-3374", "CVE-2019-3856", "CVE-2017-13716", "CVE-2016-2779", "CVE-2019-3862", "CVE-2018-19486", "CVE-2018-20506", "CVE-2019-3855", "CVE-2019-3859", "CVE-2019-6111", "CVE-2019-3860", "CVE-2019-3822", "CVE-2018-3741", "CVE-2018-16839", "CVE-2017-8421", "CVE-2018-16842", "CVE-2018-16487"], "description": "A Simple and Comprehensive [ Vulnerability Scanner ](<https://www.kitploit.com/search/label/Vulnerability%20Scanner> \"Vulnerability Scanner\" ) for Containers, Suitable for CI. \n \n\n\n[  ](<https://1.bp.blogspot.com/-1UySMBavE18/XbTjD34g1JI/AAAAAAAAQu4/4Te6530_9tYsuMryQd-Se0KGB4nkAY7IgCNcBGAsYHQ/s1600/trivy_7_usage.gif>)\n\n \n\n\n[  ](<https://1.bp.blogspot.com/-TYOxC4Qbct0/XbTjCrjEsxI/AAAAAAAAQuw/YGfdv_fB-HcijuGyoJsxeM2l4q1D9lcPgCNcBGAsYHQ/s1600/trivy_9_usage2.png>)\n\n \n\n\n[  ](<https://1.bp.blogspot.com/-sAp8dBwyVio/XbTjC1BIl1I/AAAAAAAAQu0/jfNQGljukp47bc9yJ_QX6nghXis43LkJQCNcBGAsYHQ/s1600/trivy_8_usage1.png>)\n\n \n** Abstract ** \n` Trivy ` ( ` tri ` pronounced like ** tri ** gger, ` vy ` pronounced like en ** vy ** ) is a simple and comprehensive vulnerability scanner for containers. A software vulnerability is a glitch, flaw, or weakness present in the software or in an Operating System. ` Trivy ` detects vulnerabilities of OS packages (Alpine, RHEL, CentOS, etc.) and application dependencies (Bundler, Composer, npm, yarn etc.). ` Trivy ` is easy to use. Just install the binary and you're ready to scan. All you need to do for scanning is to specify an image name of container. \nIt is considered to be used in CI. Before pushing to a container registry, you can scan your local container image easily. See [ here ](<https://github.com/aquasecurity/trivy#continuous-integration-ci> \"here\" ) for details. \n \n** Features ** \n\n\n * Detect comprehensive vulnerabilities \n * OS packages (Alpine, ** Red Hat Universal Base Image ** , [ Red Hat Enterprise ](<https://www.kitploit.com/search/label/Red%20Hat%20Enterprise> \"Red Hat Enterprise\" ) Linux, CentOS, Debian and Ubuntu) \n * ** Application dependencies ** (Bundler, Composer, Pipenv, Poetry, npm, yarn and Cargo) \n * Simple \n * Specify only an image name \n * See [ Quick Start ](<https://github.com/aquasecurity/trivy#quick-start> \"Quick Start\" ) and [ Examples ](<https://github.com/aquasecurity/trivy#examples> \"Examples\" )\n * Easy installation \n * ` apt-get install ` , ` yum install ` and ` brew install ` is possible (See [ Installation ](<https://github.com/aquasecurity/trivy#installation> \"Installation\" ) ) \n * ** No need for prerequirements ** such as installation of DB, libraries, etc. (The exception is that you need ` rpm ` installed to scan images based on RHEL/CentOS. This is automatically included if you use our installers or the Trivy container image. See [ Vulnerability Detection ](<https://github.com/aquasecurity/trivy#vulnerability-detection> \"Vulnerability Detection\" ) for background information.) \n * High accuracy \n * ** Especially Alpine Linux and RHEL/CentOS **\n * Other OSes are also high \n * DevSecOps \n * ** Suitable for CI ** such as Travis CI, CircleCI, Jenkins, etc. \n * See [ CI Example ](<https://github.com/aquasecurity/trivy#continuous-integration-ci> \"CI Example\" )\n \n** Installation ** \n \n** RHEL/CentOS ** \nAdd repository setting to ` /etc/yum.repos.d ` . \n\n \n \n $ sudo vim /etc/yum.repos.d/trivy.repo\n [trivy]\n name=Trivy repository\n baseurl=https://aquasecurity.github.io/trivy-repo/rpm/releases/$releasever/$basearch/\n gpgcheck=0\n enabled=1\n $ sudo yum -y update\n $ sudo yum -y install trivy\n\nor \n\n \n \n $ rpm -ivh https://github.com/aquasecurity/trivy/releases/download/v0.1.6/trivy_0.1.6_Linux-64bit.rpm\n\n \n** Debian/Ubuntu ** \nAdd repository to ` /etc/apt/sources.list.d ` . \n\n \n \n $ sudo apt-get install wget apt-transport-https gnupg lsb-release\n $ wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -\n $ echo deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main | sudo tee -a /etc/apt/sources.list.d/trivy.list\n $ sudo apt-get update\n $ sudo apt-get install trivy\n\nor \n\n \n \n $ sudo apt-get install rpm\n $ wget https://github.com/aquasecurity/trivy/releases/download/v0.1.6/trivy_0.1.6_Linux-64bit.deb\n $ sudo dpkg -i trivy_0.1.6_Linux-64bit.deb\n\n \n** Arch Linux ** \nPackage trivy-bin can be installed from the Arch User Repository. Examples: \n\n \n \n pikaur -Sy trivy-bin\n\nor \n\n \n \n yay -Sy trivy-bin\n\n \n** Homebrew ** \nYou can use homebrew on macOS. \n\n \n \n $ brew install aquasecurity/trivy/trivy\n\n \n** Binary (Including Windows) ** \nGet the latest version from [ this page ](<https://github.com/aquasecurity/trivy/releases/latest> \"this page\" ) , and download the archive file for your operating system/architecture. Unpack the archive, and put the binary somewhere in your ` $PATH ` (on UNIX-y systems, /usr/local/bin or the like). Make sure it has execution bits turned on. \nYou also need to install ` rpm ` command for scanning images based on RHEL/CentOS. \n \n** From source ** \n\n \n \n $ mkdir -p $GOPATH/src/github.com/aquasecurity\n $ cd $GOPATH/src/github.com/aquasecurity\n $ git clone https://github.com/aquasecurity/trivy\n $ cd trivy/cmd/trivy/\n $ export GO111MODULE=on\n $ go install\n\nYou also need to install ` rpm ` command for scanning images based on RHEL/CentOS. \n \n** Quick Start ** \nSimply specify an image name (and a tag). ** The ` latest ` tag should be avoided as problems occur with cache. ** . See [ Clear image caches ](<https://github.com/aquasecurity/trivy#clear-image-caches> \"Clear image caches\" ) . \n \n** Basic ** \n\n \n \n $ trivy [YOUR_IMAGE_NAME]\n\nFor example: \n\n \n \n $ trivy python:3.4-alpine\n\n \n \nResult \n\n \n \n 2019-05-16T01:20:43.180+0900 INFO Updating vulnerability database...\n 2019-05-16T01:20:53.029+0900 INFO Detecting Alpine vulnerabilities...\n \n python:3.4-alpine3.9 (alpine 3.9.2)\n ===================================\n Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)\n \n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | openssl | CVE-2019-1543 | MEDIUM | 1.1.1a-r1 | 1.1.1b-r1 | openssl: ChaCha20-Poly1305 |\n | | | | | | with long nonces |\n +---------+------------------+----------+-------------------+---------------+------------------- -------------+\n\n \n** Docker ** \nReplace [YOUR_CACHE_DIR] with the cache directory on your machine. \n\n \n \n $ docker run --rm -v [YOUR_CACHE_DIR]:/root/.cache/ aquasec/trivy [YOUR_IMAGE_NAME]\n\nExample for macOS: \n\n \n \n $ docker run --rm -v $HOME/Library/Caches:/root/.cache/ aquasec/trivy python:3.4-alpine\n\nIf you would like to scan the image on your host machine, you need to mount ` docker.sock ` . \n\n \n \n $ docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \\\n -v $HOME/Library/Caches:/root/.cache/ aquasec/trivy python:3.4-alpine\n\nPlease re-pull latest ` aquasec/trivy ` if an error occurred. \n \n \nResult \n\n \n \n 2019-05-16T01:20:43.180+0900 INFO Updating vulnerability database...\n 2019-05-16T01:20:53.029+0900 INFO Detecting Alpine vulnerabilities...\n \n python:3.4-alpine3.9 (alpine 3.9.2)\n ===================================\n Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)\n \n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | openssl | CVE-2019-1543 | MEDIUM | 1.1.1a-r1 | 1.1.1b-r1 | openssl: ChaCha20-Poly1305 |\n | | | | | | with long nonces |\n +---------+------------------+----------+-------------------+---------------+------------------- -------------+\n\n \n** Examples ** \n \n** Scan an image ** \nSimply specify an image name (and a tag). \n\n \n \n $ trivy knqyf263/vuln-image:1.2.3\n\n \n \nResult \n\n \n \n 2019-05-16T12:58:55.967+0900 INFO Updating vulnerability database...\n 2019-05-16T12:59:03.150+0900 INFO Detecting Alpine vulnerabilities...\n 2019-05-16T12:59:03.156+0900 INFO Updating bundler Security DB...\n 2019-05-16T12:59:04.941+0900 INFO Detecting bundler vulnerabilities...\n 2019-05-16T12:59:04.942+0900 INFO Updating cargo Security DB...\n 2019-05-16T12:59:05.967+0900 INFO Detecting cargo vulnerabilities...\n 2019-05-16T12:59:05.967+0900 INFO Updating composer Security DB...\n 2019-05-16T12:59:07.834+0900 INFO Detecting composer vulnerabilities...\n 2019-05-16T12:59:07.834+0900 INFO Updating npm Security DB...\n 2019-05-16T12:59:10.285+0900 INFO Detecting npm vulnerabilities...\n 2019-05-16T12:59:10.285+0900 INFO Updating pipenv Security DB...\n 2019-05-16T12:59:11.487+0900 INFO Detecting pipenv vulnerabilities...\n \n knqyf263/vuln-image:1.2.3 (alpine 3.7.1)\n ===== ===================================\n Total: 26 (UNKNOWN: 0, LOW: 3, MEDIUM: 16, HIGH: 5, CRITICAL: 2)\n \n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | curl | CVE-2018-14618 | CRITICAL | 7.61.0-r0 | 7.61.1-r0 | curl: NTLM password overflow |\n | | | | | | via integer overflow |\n + +------------------+----------+ +---------------+----------------------------------+\n | | CVE-2018-16839 | HIGH | | 7.61.1-r1 | curl: Integer overflow leading |\n | | | | | | to heap-based buffer overflow in |\n | | | | | | Curl_sasl_create_plain_message() |\n + +------------------+ + +---------------+----------------------------------+\n | | CVE-2019-3822 | | | 7.61.1-r2 | curl: NTLMv2 type-3 header |\n | | | | | | stack buffer overflow |\n + +------------------+ + +---------------+----------------------------------+\n | | CVE-2018-16840 | | | 7.61.1-r1 | curl: Use-after-free when |\n | | | | | | closing \"easy\" handle in |\n | | | | | | Curl_close() |\n + +------------------+----------+ + +----------------------------------+\n | | CVE-2018-16842 | MEDIUM | | | curl: Heap-based buffer |\n | | | | | | over-read in the curl tool |\n | | | | | | warning formatting |\n + +------------------+ + +---------------+----------------------------------+\n | | CVE-2018-16890 | | | 7.61.1-r2 | curl: NTLM type-2 heap |\n | | | | | | out-of-bounds buffer read |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3823 | | | | curl: SMTP end-of-response |\n | | | | | | out-of-bounds read |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | git | CVE-2018-17456 | HIGH | 2.15.2-r0 | 2.15.3-r0 | git: arbitrary code execution |\n | | | | | | via .gitmodules |\n + +------------------+ + + +----------------------------------+\n | | CVE-2018-19486 | | | | git: Improper handling of |\n | | | | | | PATH allows for commands to be |\n | | | | | | executed from... |\n +---------+-- ----------------+----------+-------------------+---------------+----------------------------------+\n | libssh2 | CVE-2019-3855 | CRITICAL | 1.8.0-r2 | 1.8.1-r0 | libssh2: Integer overflow in |\n | | | | | | transport read resulting in |\n | | | | | | out of bounds write... |\n + +------------------+----------+ + +----------------------------------+\n | | CVE-2019-3859 | MEDIUM | | | libssh2: Unchecked use of |\n | | | | | | _libssh2_packet_require and |\n | | | | | | _libssh2_packet_requirev |\n | | | | | | resulting in out-of-bounds |\n | | | | | | read |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3858 | | | | libssh2: Zero-byte allocation |\n | | | | | | with a specially crafted SFTP |\n | | | | | | packed leading to an... |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3863 | | | | libssh2: Integer overflow |\n | | | | | | in user authenticate |\n | | | | | | keyboard interactive allows |\n | | | | | | out-of-bounds writes |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3862 | | | | libssh2: Out-of-bounds memory |\n | | | | | | comparison with specially |\n | | | | | | crafted message channel |\n | | | | | | request |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3860 | | | | l ibssh2: Out-of-bounds reads |\n | | | | | | with specially crafted SFTP |\n | | | | | | packets |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3857 | | | | libssh2: Integer overflow in |\n | | | | | | SSH packet processing channel |\n | | | | | | resulting in out of... |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3861 | | | | libssh2: Out-of-bounds reads |\n | | | | | | with specially crafted SSH |\n | | | | | | packets |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3856 | | | | libssh2: Integer overflow in |\n | | | | | | keyboard interactive handling |\n | | | | | | resulting in out of bounds... |\n +---------+------------------+ +-------------------+---------------+----------------------------------+\n | libxml2 | CVE-2018-14567 | | 2.9.7-r0 | 2.9.8-r1 | libxml2: Infinite loop when |\n | | | | | | --with-lzma is used allows for |\n | | | | | | denial of service... |\n + +------------------+ + + +----------------------------------+\n | | CVE-2018-14404 | | | | libxml2: NULL pointer |\n | | | | | | dereference in |\n | | | | | | xpath.c:xmlXPathCompOpEval() |\n | | | | | | can allow attackers to cause |\n | | | | | | a... |\n + +------------------+- ---------+ + +----------------------------------+\n | | CVE-2018-9251 | LOW | | | libxml2: infinite loop in |\n | | | | | | xz_decomp function in xzlib.c |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | openssh | CVE-2019-6109 | MEDIUM | 7.5_p1-r9 | 7.5_p1-r10 | openssh: Missing character |\n | | | | | | encoding in progress display |\n | | | | | | allows for spoofing of scp... |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-6111 | | | | openssh: Impro per validation |\n | | | | | | of object names allows |\n | | | | | | malicious server to overwrite |\n | | | | | | files... |\n + +------------------+----------+ + +----------------------------------+\n | | CVE-2018-20685 | LOW | | | openssh: scp client improper |\n | | | | | | directory name validation |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | sqlite | CVE-2018-20346 | MEDIUM | 3.21.0-r1 | 3.25.3-r0 | sqlite: Multiple flaws in |\n | | | | | | sqlite which can be triggered |\n | | | | | | via corrupted internal... |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | tar | CVE-2018-20482 | LOW | 1.29-r1 | 1.31-r0 | tar: Infinite read loop in |\n | | | | | | sparse_dump_region function in |\n | | | | | | sparse.c |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n \n ruby-app/Gemfile.lock\n =====================\n Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)\n \n +----------------------+------------------+----------+-------------------+----------- ----+--------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +----------------------+------------------+----------+-------------------+---------------+--------------------------------+\n | rails-html-sanitizer | CVE-2018-3741 | MEDIUM | 1.0.3 | >= 1.0.4 | rubygem-rails-html-sanitizer: |\n | | | | | | non-whitelisted attributes |\n | | | | | | are present in sanitized |\n | | | | | | output when input with |\n | | | | | | specially-crafted... |\n +----------------------+------------------+----------+- ------------------+---------------+--------------------------------+\n \n rust-app/Cargo.lock\n ===================\n Total: 3 (UNKNOWN: 3, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)\n \n +---------+-------------------+----------+-------------------+---------------+--------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +---------+-------------------+----------+-------------------+---------------+--------------------------------+\n | ammonia | RUSTSEC-2019-0001 | UNKNOWN | 1.9.0 | >= 2.1.0 | Uncontrolled recursion leads |\n | | | | | | to abort in HTML serialization |\n +---------+-------------------+ +-------------------+---------------+--------------------------------+\n | openssl | RUSTSEC-2016-0001 | | 0.8.3 | >= 0.9.0 | SSL/TLS MitM vulne rability due |\n | | | | | | to insecure defaults |\n + +-------------------+ + +---------------+--------------------------------+\n | | RUSTSEC-2018-0010 | | | >= 0.10.9 | Use after free in CMS Signing |\n +---------+-------------------+----------+-------------------+---------------+--------------------------------+\n \n php-app/composer.lock\n =====================\n Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)\n \n +-------------------+------------------+----------+-------------------+---------------------+--------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +-------------------+------------------+----------+-------------------+---------------------+--------------------------- -----+\n | guzzlehttp/guzzle | CVE-2016-5385 | MEDIUM | 6.2.0 | 6.2.1, 4.2.4, 5.3.1 | PHP: sets environmental |\n | | | | | | variable based on user |\n | | | | | | supplied Proxy request header |\n +-------------------+------------------+----------+-------------------+---------------------+--------------------------------+\n \n node-app/package-lock.json\n ==========================\n Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 3, HIGH: 1, CRITICAL: 0)\n \n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +---------+------------------+----------+-------------------+---------------+---------------- ----------------+\n | jquery | CVE-2019-5428 | MEDIUM | 3.3.9 | >=3.4.0 | Modification of |\n | | | | | | Assumed-Immutable Data (MAID) |\n + +------------------+ + + +--------------------------------+\n | | CVE-2019-11358 | | | | js-jquery: prototype pollution |\n | | | | | | in object's prototype leading |\n | | | | | | to denial of service or... |\n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | lodash | CVE-2018-16487 | HIGH | 4.17.4 | >=4.17.11 | lodash: Prototype pollution in |\n | | | | | | utilities function |\n + +------------------+----------+ +---------------+ +\n | | CVE-2018-3721 | MEDIUM | | >=4.17.5 | |\n | | | | | | |\n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n \n python-app/Pipfile.lock\n =======================\n Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)\n \n +---------+------------------+----------+-------------------+---------------+------------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +---------+------------------+----------+-------------------+---------------+------------------------------------+\n | django | CVE-2019-6975 | MEDIUM | 2.0.9 | 2.0.11 | python-django: |\n | | | | | | memory exhaustion in |\n | | | | | | django.utils.numberformat.format() |\n +---------+------------------+----------+-------------------+---------------+------------------------------------+\n\n \n \n** Scan an image file ** \n\n \n \n $ docker save ruby:2.3.0-alpine3.9 -o ruby-2.3.0.tar\n $ trivy --input ruby-2.3.0.tar\n\n \n \nResult \n\n \n \n 2019-05-16T12:45:57.332+0900 INFO Updating vulnerability database...\n 2019-05-16T12:45:59.119+0900 INFO Detecting Debian vulnerabilities...\n \n ruby-2.3.0.tar (debian 8.4)\n ===========================\n Total: 7447 (UNKNOWN: 5, LOW: 326, MEDIUM: 5695, HIGH: 1316, CRITICAL: 105)\n \n +------------------------------+---------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +------------------------------+---------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------+\n | apt | CVE-2019-3462 | CRITICAL | 1.0.9.8.3 | 1.0.9.8.5 | Incorrect sanitation of the |\n | | | | | | 302 redirect field in HTTP |\n | | | | | | transport method of... |\n + +---------------------+----------+ +----------------------------------+-----------------------------------------------------+\n | | CVE-2016-1252 | MEDIUM | | 1.0.9.8.4 | The apt package in Debian |\n | | | | | | jessie before 1.0.9.8.4, in |\n | | | | | | Debian unstable before... |\n + +---------------------+----------+ +----------------------------------+-----------------------------------------------------+\n | | CVE-2011-3374 | LOW | | | |\n +------------------------------+---------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------+\n | bash | CVE-2016-7543 | HIGH | 4.3-11 | 4.3-11+deb8u1 | bash: Specially crafted |\n | | | | | | SHELLOPTS+PS4 variables allows |\n | | | | | | command substitution |\n + +---------------------+ + +----------------------------------+-----------------------------------------------------+\n | | CVE-2019-9924 | | | 4.3-11+deb8u2 | bash: BASH_CMD is writable in |\n | | | | | | restricted bash shells |\n + +---------------------+----------+ +----------------------------------+-----------------------------------------------------+\n | | CVE-2016-0634 | MEDIUM | | 4.3-11+deb8u1 | bash: Arbitrary code execution |\n | | | | | | via malicious hostname |\n + +---------------------+----------+ +----------------------------------+-----------------------------------------------------+\n | | CVE-2016-9401 | LOW | | 4.3-11+deb8u2 | bash: popd controlled free |\n + +---------------------+ + +----------------------------------+--------------------- --------------------------------+\n | | TEMP-0841856-B18BAF | | | | |\n +------------------------------+---------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------\n ...\n\n \n \n** Save the results as JSON ** \n\n \n \n $ trivy -f json -o results.json golang:1.12-alpine\n\n \n \nResult \n\n \n \n 2019-05-16T01:46:31.777+0900 INFO Updating vulnerability database...\n 2019-05-16T01:47:03.007+0900 INFO Detecting Alpine vulnerabilities...\n\n \nJSON \n\n \n \n [\n {\n \"Target\": \"php-app/composer.lock\",\n \"Vulnerabilities\": null\n },\n {\n \"Target\": \"node-app/package-lock.json\",\n \"Vulnerabilities\": [\n {\n \"VulnerabilityID\": \"CVE-2018-16487\",\n \"PkgName\": \"lodash\",\n \"InstalledVersion\": \"4.17.4\",\n \"FixedVersion\": \"\\u003e=4.17.11\",\n \"Title\": \"lodash: Prototype pollution in utilities function\",\n \"Description\": \"A prototype pollution vulnerability was found in lodash \\u003c4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.\",\n \"Severity\": \"HIGH\",\n \"References\": [\n \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16487\",\n ]\n }\n ]\n },\n {\n \"Target\": \"trivy-ci-test (alpine 3.7.1)\",\n \"Vulnerabilities\": [\n {\n \"VulnerabilityID\": \"CVE-2018-1 6840\",\n \"PkgName\": \"curl\",\n \"InstalledVersion\": \"7.61.0-r0\",\n \"FixedVersion\": \"7.61.1-r1\",\n \"Title\": \"curl: Use-after-free when closing \\\"easy\\\" handle in Curl_close()\",\n \"Description\": \"A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. \",\n \"Severity\": \"HIGH\",\n \"References\": [\n \"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16840\",\n ]\n },\n {\n \"VulnerabilityID\": \"CVE-2019-3822\",\n \"PkgName\": \"curl\",\n \"InstalledVersion\": \"7.61.0-r0\",\n \"FixedVersion\": \"7.61.1-r2\",\n \"Title\": \"curl: NTLMv2 type-3 header stack buffer overflow\",\n \"Description\": \"libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. \",\n \"Severity\": \"HIGH\",\n \"References\": [\n \"https:/ /curl.haxx.se/docs/CVE-2019-3822.html\",\n \"https://lists.apache.org/thread.html/[email\u00a0protected]%3Cdevnull.infra.apache.org%3E\"\n ]\n },\n {\n \"VulnerabilityID\": \"CVE-2018-16839\",\n \"PkgName\": \"curl\",\n \"InstalledVersion\": \"7.61.0-r0\",\n \"FixedVersion\": \"7.61.1-r1\",\n \"Title\": \"curl: Integer overflow leading to heap-based buffer overflow in Curl_sasl_create_plain_message()\",\n \"Description\": \"Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.\",\n \"Severity\": \"HIGH\",\n \"References\": [\n \"https://github.com/curl/curl/commit/f3a24d7916b9173c69a3e0ee790102993833d6c5\",\n ]\n },\n {\n \"VulnerabilityID\": \"CVE-2018-19486\",\n \"PkgName\": \"git\",\n \"InstalledVersion\": \"2.15.2-r0\",\n \"FixedVersion\": \"2.15.3-r0\",\n \"Title\": \"git: Improper handling of PATH allows for commands to be executed from the current directory\",\n \"Description\": \"Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was a dangerous change from execvp to execv during 2017.\",\n \"Severity\": \"HIGH\",\n \"References\": [\n \"https://usn.ubuntu.com/3829-1/\",\n ]\n },\n {\n \"VulnerabilityID\": \"CVE-2018-17456\",\n \"PkgName\": \"git\",\n \"InstalledVersion\": \"2.15.2-r0\",\n \"FixedVersion\": \"2.15.3-r0\",\n \"Title\": \"git: arbitrary code execution via .gitmodules\",\n \"Description\": \"Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows [remote code execution](<https://www.kitploit.com/search/label/Remote%20Code%20Execution> \"remote code execution\" ) during processing of a recursive \\\"git clone\\\" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.\",\n \"Severity\": \"HIGH\",\n \"References\": [\n \"http://www.securitytracker.com/id/1041811\",\n ]\n }\n ]\n },\n {\n \"Target\": \"python-app/Pipfile.lock\",\n \"Vulnerabilities\": null\n },\n {\n \"Target\": \"ruby-app/Gemfile.lock\",\n \"Vulnerabilities\": null\n },\n {\n \"Target\": \"rust-app/Cargo.lock\",\n \"Vulnerabilities\": null\n }\n ]\n\n \n \n** Filter the vulnerabilities by severities ** \n\n \n \n $ trivy --severity HIGH,CRITICAL ruby:2.3.0\n\n \n \nResult \n\n \n \n 2019-05-16T01:51:46.255+0900 INFO Updating vulnerability database...\n 2019-05-16T01:51:49.213+0900 INFO Detecting Debian vulnerabilities...\n \n ruby:2.3.0 (debian 8.4)\n =======================\n Total: 1785 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1680, CRITICAL: 105)\n \n +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+\n | apt | CVE-2019-3462 | CRITICAL | 1.0.9.8.3 | 1.0.9.8.5 | Incorrect sanitation of t he |\n | | | | | | 302 redirect field in HTTP |\n | | | | | | transport method of... |\n +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+\n | bash | CVE-2019-9924 | HIGH | 4.3-11 | 4.3-11+deb8u2 | bash: BASH_CMD is writable in |\n | | | | | | restricted bash shells |\n + +------------------+ + +----------------------------------+-------------------------------------------------+\n | | CVE-2016-7543 | | | 4.3-11+deb8u1 | bash: Specially crafted |\n | | | | | | SHELLOPTS+PS4 variables allows |\n | | | | | | command substitution |\n +-----------------------------+------------------+ +---------------------------+----------------------------------+-------------------------------------------------+\n | binutils | CVE-2017-8421 | | 2.25-5 | | binutils: Memory exhaustion in |< br/>| | | | | | objdump via a crafted PE file |\n + +------------------+ + +----------------------------------+-------------------------------------------------+\n | | CVE-2017-14930 | | | | binutils: Memory leak in |\n | | | | | | decode_line_info |\n + +------------------+ + +----------------------------------+-------------------------------------------------+\n | | CVE-2017-7614 | | | | binutils: NULL |\n | | | | | | pointer dereference in |\n | | | | | | bfd_elf_final_link function |\n + +------------------+ + +----------------------------------+-------------------------------------------------+\n | | CVE-2014-9939 | | | | binutils: buffer overflow in |\n | | | | | | ihex.c |\n + +------------------+ + +----------------------------------+-------------------------------------------------+\n | | CVE-2017-13716 | | | | binutils: Memory leak with the |\n | | | | | | C++ symbol demangler routine |\n | | | | | | in libiberty |\n + +------------------+ + +----------------------------------+-------------------------------------------------+\n | | CVE-2018-12699 | | | | binutils: heap-based buffer |\n | | | | | | overflow in finish_stab in |\n | | | | | | stabs.c |\n +-----------------------------+------------------+ +---------------------------+----------------------------------+-------------------------------------------------+\n | bsdutils | CVE-2015-5224 | | 2.25.2-6 | | util-linux: File name |\n | | | | | | collision due to incorrect |\n | | | | | | mkstemp use |\n + +------------------+ + +----------------------------------+-------------------------------------------------+\n | | CVE-2016-2779 | | | | util-linux: runuser tty hijack |\n | | | | | | via TIOCSTI ioctl |\n +-----------------------------+------------------+----------+---------------------------+----------------------------------+-------------------------------------------------+\n\n \n \n** Filter the vulnerabilities by type ** \n\n \n \n $ trivy --vuln-type os ruby:2.3.0\n\nAvailable values: \n\n\n * library \n * os \n \nResult \n\n \n \n 2019-05-22T19:36:50.530+0200 [34mINFO[0m Updating vulnerability database...\n 2019-05-22T19:36:51.681+0200 [34mINFO[0m Detecting Alpine vulnerabilities...\n 2019-05-22T19:36:51.685+0200 [34mINFO[0m Updating npm Security DB...\n 2019-05-22T19:36:52.389+0200 [34mINFO[0m Detecting npm vulnerabilities...\n 2019-05-22T19:36:52.390+0200 [34mINFO[0m Updating pipenv Security DB...\n 2019-05-22T19:36:53.406+0200 [34mINFO[0m Detecting pipenv vulnerabilities...\n \n ruby:2.3.0 (debian 8.4)\n Total: 4751 (UNKNOWN: 1, LOW: 150, MEDIUM: 3504, HIGH: 1013, CRITICAL: 83)\n \n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +---------+------------------+----------+-------------------+---------- -----+----------------------------------+\n | curl | CVE-2018-14618 | CRITICAL | 7.61.0-r0 | 7.61.1-r0 | curl: NTLM password overflow |\n | | | | | | via integer overflow |\n + +------------------+----------+ +---------------+----------------------------------+\n | | CVE-2018-16839 | HIGH | | 7.61.1-r1 | curl: Integer overflow leading |\n | | | | | | to heap-based buffer overflow in |\n | | | | | | Curl_sasl_create_plain_message() |\n + +------------------+ + +---------------+----------------------------------+\n | | CVE-2019-3822 | | | 7.61.1-r2 | curl: NTLMv2 type-3 header |\n | | | | | | stack buffer overflow |\n + +------------------+ + +---------------+----------------------------------+\n | | CVE-2018-16840 | | | 7.61.1-r1 | curl: Use-after-free when |\n | | | | | | closing \"easy\" handle in |\n | | | | | | Curl_close() |\n + +------------------+----------+ +---------------+----------------------------------+\n | | CVE-2019-3823 | MEDIUM | | 7.61.1-r2 | curl: SMTP end-of-response |\n | | | | | | out-of-bounds read |\n + +------------------+ + + +----------------------------------+\n | | CVE-2018-16890 | | | | curl: NTLM type-2 heap |\n | | | | | | out-of-bounds buffer read |\n + +------------------+ + +---------------+----------------------------------+\n | | CVE-2018-16842 | | | 7.61.1-r1 | curl: Heap-based buffer |\n | | | | | | over-read in the curl tool |\n | | | | | | warning formatting |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | git | CVE-2018-17456 | HIGH | 2.15.2-r0 | 2.15.3-r0 | git: arbitrary code execution |\n | | | | | | via .gitmodules |\n + +------------------+ + + +----------------------------------+\n | | CVE-2018-19486 | | | | git: Improper handling of |\n | | | | | | PATH allows for commands to be |\n | | | | | | executed from... |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | libssh2 | CVE-2019-3855 | CRITICAL | 1.8.0-r2 | 1.8.1-r0 | libssh2: Integer overflow in |\n | | | | | | transport read resulting in |\n | | | | | | out of bounds write... |\n + +------------------+----------+ + +----------------------------------+\n | | CVE-2019-3861 | MEDIUM | | | libssh2: Out-of-bounds reads |\n | | | | | | with specially crafted SSH |\n | | | | | | packets |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3857 | | | | libssh2: Integer overflow in |\n | | | | | | SSH packet processing channel |\n | | | | | | resulting in out of... |\n + +-------------- ----+ + + +----------------------------------+\n | | CVE-2019-3856 | | | | libssh2: Integer overflow in |\n | | | | | | keyboard interactive handling |\n | | | | | | resulting in out of bounds... |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3863 | | | | libssh2: Integer overflow |\n | | | | | | in user authenticate |\n | | | | | | keyboard interactive allows |\n | | | | | | out-of-b ounds writes |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3862 | | | | libssh2: Out-of-bounds memory |\n | | | | | | comparison with specially |\n | | | | | | crafted message channel |\n | | | | | | request |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3860 | | | | libssh2: Out-of-bounds reads |\n | | | | | | with specially crafted SFTP |\n | | | | | | packets |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3858 | | | | libssh2: Zero-byte allocation |\n | | | | | | with a specially crafted SFTP |\n | | | | | | packed leading to an... |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-3859 | | | | libssh2: Unchecked use of |\n | | | | | | _libssh2_packet_require and |\n | | | | | | _libssh2_pack et_requirev |\n | | | | | | resulting in out-of-bounds |\n | | | | | | read |\n +---------+------------------+ +-------------------+---------------+----------------------------------+\n | libxml2 | CVE-2018-14404 | | 2.9.7-r0 | 2.9.8-r1 | libxml2: NULL pointer |\n | | | | | | dereference in |\n | | | | | | xpath.c:xmlXPathCompOpEval() |\n | | | | | | can allow attackers to cause |\n | | | | | | a... |\n + +------------------+ + + +----------------------------------+\n | | CVE-2018-14567 | | | | libxml2: Infinite loop when |\n | | | | | | --with-lzma is used allows for |\n | | | | | | denial of service... |\n + +------------------+----------+ + +----------------------------------+\n | | CVE-2018-9251 | LOW | | | libxml2: infinite loop in |\n | | | | | | xz_decomp function in xzlib.c |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | openssh | CVE-2019-6109 | MEDIUM | 7.5_p1-r9 | 7.5_p1-r10 | openssh: Missing c haracter |\n | | | | | | encoding in progress display |\n | | | | | | allows for spoofing of scp... |\n + +------------------+ + + +----------------------------------+\n | | CVE-2019-6111 | | | | openssh: Improper validation |\n | | | | | | of object names allows |\n | | | | | | malicious server to overwrite |\n | | | | | | files... |\n + +------------------+----------+ + +----------------------------------+\n | | CVE-2018-20685 | LOW | | | openssh: scp client improper |\n | | | | | | directory name validation |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | sqlite | CVE-2018-20346 | MEDIUM | 3.21.0-r1 | 3.25.3-r0 | CVE-2018-20505 CVE-2018-20506 |\n | | | | | | sqlite: Multiple flaws in |\n | | | | | | sqlite which can be triggered |\n | | | | | | via... |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n | tar | CVE-2018-20482 | LOW | 1.29-r1 | 1.31-r0 | tar: Infinite read loop in |\n | | | | | | sparse_dump_region function in |\n | | | | | | sparse.c |\n +---------+------------------+----------+-------------------+---------------+----------------------------------+\n\n \n** Skip update of vulnerability DB ** \n` Trivy ` always updates its vulnerability database when it starts operating. This is usually fast, as it is a difference update. But if you want to skip even that, use the ` --skip-update ` option. \n\n \n \n $ trivy --skip-update python:3.4-alpine3.9\n\n \n \nResult \n\n \n \n 2019-05-16T12:48:08.703+0900 INFO Detecting Alpine vulnerabilities...\n \n python:3.4-alpine3.9 (alpine 3.9.2)\n ===================================\n Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)\n \n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | openssl | CVE-2019-1543 | MEDIUM | 1.1.1a-r1 | 1.1.1b-r1 | openssl: ChaCha20-Poly1305 |\n | | | | | | with long nonces |\n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n\n \n \n** Update only specified distributions ** \nBy default, ` Trivy ` always updates its vulnerability database for all distributions. Use the ` --only-update ` option if you want to name specified distributions to update. \n\n \n \n $ trivy --only-update alpine,debian python:3.4-alpine3.9\n $ trivy --only-update alpine python:3.4-alpine3.9\n\n \n \nResult \n\n \n \n 2019-05-21T19:37:06.301+0900 INFO Updating vulnerability database...\n 2019-05-21T19:37:07.793+0900 INFO Updating alpine data...\n 2019-05-21T19:37:08.127+0900 INFO Detecting Alpine vulnerabilities...\n \n python:3.4-alpine3.9 (alpine 3.9.2)\n ===================================\n Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)\n \n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | openssl | CVE-2019-1543 | MEDIUM | 1.1.1a-r1 | 1.1.1b-r1 | openssl: ChaCha20-Poly1305 |\n | | | | | | with long nonces |\n +---------+----------------- -+----------+-------------------+---------------+--------------------------------+\n\n \n \n** Ignore unfixed vulnerabilities ** \nBy default, ` Trivy ` also detects unpatched/unfixed vulnerabilities. This means you can't fix these vulnerabilities even if you update all packages. If you would like to ignore them, use the ` --ignore-unfixed ` option. \n\n \n \n $ trivy --ignore-unfixed ruby:2.3.0\n\n \n \nResult \n\n \n \n 2019-05-16T12:49:52.656+0900 INFO Updating vulnerability database...\n 2019-05-16T12:50:14.786+0900 INFO Detecting Debian vulnerabilities...\n \n ruby:2.3.0 (debian 8.4)\n =======================\n Total: 4730 (UNKNOWN: 1, LOW: 145, MEDIUM: 3487, HIGH: 1014, CRITICAL: 83)\n \n +------------------------------+------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +------------------------------+------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------+\n | apt | CVE-2019-3462 | CRITICAL | 1.0.9.8.3 | 1.0.9.8.5 | I ncorrect sanitation of the |\n | | | | | | 302 redirect field in HTTP |\n | | | | | | transport method of... |\n + +------------------+----------+ +----------------------------------+-----------------------------------------------------+\n | | CVE-2016-1252 | MEDIUM | | 1.0.9.8.4 | The apt package in Debian |\n | | | | | | jessie before 1.0.9.8.4, in |\n | | | | | | Debian unstable before... |\n +------------------------------+------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------+\n | bash | CVE-2019-9924 | HIGH | 4.3-11 | 4.3-11+deb8u2 | bash: BASH_CMD is writable in |\n | | | | | | restricted bash shells |\n + +------------------+ + +----------------------------------+-----------------------------------------------------+\n | | CVE-2016-7543 | | | 4.3-11+deb8u1 | bash: Specially crafted |\n | | | | | | SHELLOPTS+PS4 variables allows |\n | | | | | | command substitution |\n + +------------------+----------+ + +-----------------------------------------------------+\n | | CVE-2016-0634 | MEDIUM | | | bash: Arbitrary code execution |\n | | | | | | via malicious hostname |\n + +------------------+----------+ +----------------------------------+-----------------------------------------------------+\n | | CVE-2016-9401 | LOW | | 4.3-11+deb8u2 | bash: popd controlled free |\n +------------------------------+------------------+----------+----------------------------+----------------------------------+-----------------------------------------------------+\n ...\n\n \n \n** Specify exit code ** \nBy default, ` Trivy ` exits with code 0 even when vulnerabilities are detected. Use the ` --exit-code ` option if you want to exit with a non-zero exit code. \n\n \n \n $ trivy --exit-code 1 python:3.4-alpine3.9\n\n \n \nResult \n\n \n \n 2019-05-16T12:51:43.500+0900 INFO Updating vulnerability database...\n 2019-05-16T12:52:00.387+0900 INFO Detecting Alpine vulnerabilities...\n \n python:3.4-alpine3.9 (alpine 3.9.2)\n ===================================\n Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)\n \n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +---------+------------------+----------+-------------------+---------------+--------------------------------+\n | openssl | CVE-2019-1543 | MEDIUM | 1.1.1a-r1 | 1.1.1b-r1 | openssl: ChaCha20-Poly1305 |\n | | | | | | with long nonces |\n +---------+------------------+----------+-------------------+---------------+------------------- -------------+\n\n \n \nThis option is useful for CI/CD. In the following example, the test will fail only when a critical vulnerability is found. \n\n \n \n $ trivy --exit-code 0 --severity MEDIUM,HIGH ruby:2.3.0\n $ trivy --exit-code 1 --severity CRITICAL ruby:2.3.0\n\n \n** Ignore the specified vulnerabilities ** \nUse ` .trivyignore ` . \n\n \n \n $ cat .trivyignore\n # Accept the risk\n CVE-2018-14618\n \n # No impact in our settings\n CVE-2019-1543\n \n $ trivy python:3.4-alpine3.9\n\n \n \nResult \n\n \n \n 2019-05-16T12:53:10.076+0900 INFO Updating vulnerability database...\n 2019-05-16T12:53:28.134+0900 INFO Detecting Alpine vulnerabilities...\n \n python:3.4-alpine3.9 (alpine 3.9.2)\n ===================================\n Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)\n \n\n \n \n** Specify cache directory ** \n\n \n \n $ trivy --cache-dir /tmp/trivy/ python:3.4-alpine3.9\n\n \n** Clear image caches ** \nThe ` --clear-cache ` option removes image caches. This option is useful if the image which has the same tag is updated (such as when using ` latest ` tag). \n\n \n \n $ trivy --clear-cache python:3.7\n\n \n \nResult \n\n \n \n 2019-05-16T12:55:24.749+0900 INFO Removing image caches...\n 2019-05-16T12:55:24.769+0900 INFO Updating vulnerability database...\n 2019-05-16T12:56:14.055+0900 INFO Detecting Debian vulnerabilities...\n \n python:3.7 (debian 9.9)\n =======================\n Total: 3076 (UNKNOWN: 0, LOW: 127, MEDIUM: 2358, HIGH: 578, CRITICAL: 13)\n \n +------------------------------+---------------------+----------+--------------------------+------------------+-------------------------------------------------------+\n | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |\n +------------------------------+---------------------+----------+--------------------------+------------------+-------------------------------------------------------+\n | apt | CVE-2011-3374 | LOW | 1.4.9 | | |\n +------------------------------+---------------------+ +--------------------------+------------------+-------------------------------------------------------+\n | bash | TEMP-0841856-B18BAF | | 4.4-5 | | |\n +------------------------------+---------------------+----------+--------------------------+------------------+-------------------------------------------------------+\n ...\n\n \n \n** Reset ** \nThe ` --reset ` option removes all caches and database. After this, it takes a long time as the vulnerability database needs to be rebuilt locally. \n\n \n \n $ trivy --reset\n\n \n \nResult \n\n \n \n 2019-05-16T13:05:31.935+0900 INFO Resetting...\n\n \n \n** Continuous Integration (CI) ** \nScan your image built in Travis CI/CircleCI. The test will fail if a vulnerability is found. When you don't want to fail the test, specify ` --exit-code 0 ` . \n** Note ** : It will take a while for the first time (faster by cache after the second time). \n \n** Travis CI ** \n\n \n \n $ cat .travis.yml\n services:\n - docker\n \n env:\n global:\n - COMMIT=${TRAVIS_COMMIT::8}\n \n before_install:\n - docker build -t trivy-ci-test:${COMMIT} .\n - export VERSION=$(curl --silent \"https://api.github.com/repos/aquasecurity/trivy/releases/latest\" | grep '\"tag_name\":' | sed -E 's/.*\"v([^\"]+)\".*/\\1/')\n - wget https://github.com/aquasecurity/trivy/releases/download/v${VERSION}/trivy_${VERSION}_Linux-64bit.tar.gz\n - tar zxvf trivy_${VERSION}_Linux-64bit.tar.gz\n script:\n - ./trivy --exit-code 0 --severity HIGH --no-progress --auto-refresh trivy-ci-test:${COMMIT}\n - ./trivy --exit-code 1 --severity CRITICAL --no-progress --auto-refresh trivy-ci-test:${COMMIT}\n cache:\n directories:\n - $HOME/.cache/trivy\n\nExample: [ https://travis-ci.org/aquasecurity/trivy-ci-test ](<https://travis-ci.org/aquasecurity/trivy-ci-test> \"https://travis-ci.org/aquasecurity/trivy-ci-test\" ) \nRepository: [ https://github.com/aquasecurity/trivy-ci-test ](<https://github.com/aquasecurity/trivy-ci-test> \"https://github.com/aquasecurity/trivy-ci-test\" ) \n \n** CircleCI ** \n\n \n \n $ cat .circleci/config.yml\n jobs:\n build:\n docker:\n - image: docker:18.09-git\n steps:\n - checkout\n - setup_remote_docker\n - restore_cache:\n key: vulnerability-db\n - run:\n name: Build image\n command: docker build -t trivy-ci-test:${CIRCLE_SHA1} .\n - run:\n name: Install trivy\n command: |\n apk add --update curl\n VERSION=$(\n curl --silent \"https://api.github.com/repos/aquasecurity/trivy/releases/latest\" | \\\n grep '\"tag_name\":' | \\\n sed -E 's/.*\"v([^\"]+)\".*/\\1/'\n )\n \n wget https://github.com/aquasecurity/trivy/releases/download/v${VERSION}/trivy_${VERSION}_Linux-64bit.tar.gz\n tar zxvf trivy_${VERSION}_Linux-64bit.tar.gz\n mv trivy /usr/local/bin\n - run:\n name: Scan the lo cal image with trivy\n command: trivy --exit-code 0 --no-progress --auto-refresh trivy-ci-test:${CIRCLE_SHA1}\n - save_cache:\n key: vulnerability-db\n paths:\n - $HOME/.cache/trivy\n workflows:\n version: 2\n release:\n jobs:\n - build\n\nExample: [ https://circleci.com/gh/aquasecurity/trivy-ci-test ](<https://circleci.com/gh/aquasecurity/trivy-ci-test> \"https://circleci.com/gh/aquasecurity/trivy-ci-test\" ) \nRepository: [ https://github.com/aquasecurity/trivy-ci-test ](<https://github.com/aquasecurity/trivy-ci-test> \"https://github.com/aquasecurity/trivy-ci-test\" ) \n \n** Authorization for Private Docker Registry ** \nTrivy can download images from private registry, without installing ` Docker ` and any 3rd party tools. That's because it's easy to run in a CI process. \nAll you have to do is install ` Trivy ` and set ENV vars. But, I can't recommend using ENV vars in your local machine to you. \n \n** Docker Hub ** \nDocker Hub needs ` TRIVY_AUTH_URL ` , ` TRIVY_USERNAME ` and ` TRIVY_PASSWORD ` . You don't need to set ENV vars when download from public repository. \n\n \n \n export TRIVY_AUTH_URL=https://registry.hub.docker.com\n export TRIVY_USERNAME={DOCKERHUB_USERNAME}\n export TRIVY_PASSWORD={DOCKERHUB_PASSWORD}\n\n \n** Amazon ECR (Elastic Container Registry) ** \nTrivy uses AWS SDK. You don't need to install ` aws ` CLI tool. You can use [ AWS CLI's ENV Vars ](<https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html> \"AWS CLI's ENV Vars\" ) . \n \n** GCR (Google Container Registry) ** \nTrivy uses Google Cloud SDK. You don't need to install ` gcloud ` command. \nIf you want to use target project's repository, you can settle via ` GOOGLE_APPLICATION_CREDENTIAL ` . \n\n \n \n # must set TRIVY_USERNAME empty char\n export GOOGLE_APPLICATION_CREDENTIALS=/path/to/credential.json\n\n \n** Self Hosted Registry (BasicAuth) ** \nBasicAuth server needs ` TRIVY_USERNAME ` and ` TRIVY_PASSWORD ` . \n\n \n \n export TRIVY_USERNAME={USERNAME}\n export TRIVY_PASSWORD={PASSWORD}\n \n # if you want to use 80 port, use NonSSL\n export TRIVY_NON_SSL=true\n\n \n** Vulnerability Detection ** \n \n** OS Packages ** \nThe unfixed/unfixable vulnerabilities mean that the patch has not yet been provided on their distribution. \nOS | Supported Versions | Target Packages | Detection of unfixed vulnerabilities \n---|---|---|--- \nAlpine Linux | 2.2 - 2.7, 3.0 - 3.10 | Installed by apk | NO \nRed Hat Universal Base Image | 7, 8 | Installed by yum/rpm | YES \nRed Hat Enterprise Linux | 6, 7, 8 | Installed by yum/rpm | YES \nCentOS | 6, 7 | Installed by yum/rpm | YES \nDebian GNU/Linux | wheezy, jessie, stretch, buster | Installed by apt/apt-get/dpkg | YES \nUbuntu | 12.04, 14.04, 16.04, 18.04, 18.10, 19.04 | Installed by apt/apt-get/dpkg | YES \nRHEL and CentOS package information is stored in a binary format, and Trivy uses the ` rpm ` executable to parse this information when scanning an image based on RHEL or CentOS. The Trivy container image includes ` rpm ` , and the installers include it as a dependency. If you installed the ` trivy ` binary using ` wget ` or ` curl ` , or if you build it from source, you will also need to ensure that ` rpm ` is available. \n \n** Application Dependencies ** \n` Trivy ` automatically detects the following files in the container and scans vulnerabilities in the application dependencies. \n\n\n * Gemfile.lock \n * Pipfile.lock \n * poetry.lock \n * composer.lock \n * package-lock.json \n * yarn.lock \n * Cargo.lock \nThe path of these files does not matter. \nExample: [ https://github.com/aquasecurity/trivy-ci-test/blob/master/Dockerfile ](<https://github.com/aquasecurity/trivy-ci-test/blob/master/Dockerfile> \"https://github.com/aquasecurity/trivy-ci-test/blob/master/Dockerfile\" ) \n \n** Data source ** \n\n\n * PHP \n * [ https://github.com/FriendsOfPHP/security-advisories ](<https://github.com/FriendsOfPHP/security-advisories> \"https://github.com/FriendsOfPHP/security-advisories\" )\n * Python \n * [ https://github.com/pyupio/safety-db ](<https://github.com/pyupio/safety-db> \"https://github.com/pyupio/safety-db\" )\n * Ruby \n * [ https://github.com/rubysec/ruby-advisory-db ](<https://github.com/rubysec/ruby-advisory-db> \"https://github.com/rubysec/ruby-advisory-db\" )\n * Node.js \n * [ https://github.com/nodejs/security-wg ](<https://github.com/nodejs/security-wg> \"https://github.com/nodejs/security-wg\" )\n * Rust \n * [ https://github.com/RustSec/advisory-db ](<https://github.com/RustSec/advisory-db> \"https://github.com/RustSec/advisory-db\" )\n \n** Usage ** \n\n \n \n NAME:\n trivy - A simple and comprehensive vulnerability scanner for containers\n USAGE:\n trivy [options] image_name\n VERSION:\n 0.1.6\n OPTIONS:\n --format value, -f value format (table, json) (default: \"table\")\n --input value, -i value input file path instead of image name\n --severity value, -s value severities of vulnerabilities to be displayed (comma separated) (default: \"UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL\")\n --output value, -o value output file name\n --exit-code value Exit code when vulnerabilities were found (default: 0)\n --skip-update skip db update\n --only-update value update db only specified distribution (comma separated)\n --reset remove all caches and database\n --clear-cache, -c clear image caches\n --quiet, -q suppress progress bar and log output\n --no-progress suppress progress bar\n - -ignore-unfixed display only fixed vulnerabilities\n --refresh refresh DB (usually used after version update of trivy)\n --auto-refresh refresh DB automatically when updating version of trivy\n --debug, -d debug mode\n --vuln-type value comma-separated list of vulnerability types (os,library) (default: \"os,library\")\n --cache-dir value cache directory (default: \"/path/to/cache\")\n --help, -h show help\n --version, -v print the version\n\n \n \n** Migration ** \nOn 19 August 2019, Trivy's repositories moved from ` knqyf263/trivy ` to ` aquasecurity/trivy ` . If you previously installed Trivy you should update any scripts or package manager records as described in this section. \n \n** Overview ** \nIf you have a script that installs Trivy (for example into your CI pipelines) you should update it to obtain it from the new location by replacing knqyf263/trivy with aquasecurity/trivy. \nFor example: \n\n \n \n # Before\n $ wget https://github.com/knqyf263/trivy/releases/download/v${VERSION}/trivy_${VERSION}_Linux-64bit.tar.gz\n \n # After\n $ wget https://github.com/aquasecurity/trivy/releases/download/v${VERSION}/trivy_${VERSION}_Linux-64bit.tar.gz\n\n \n** CentOS/RedHat ** \nUse [ https://aquasecurity.github.io ](<https://aquasecurity.github.io/> \"https://aquasecurity.github.io\" ) instead of [ https://knqyf263.github.io ](<https://knqyf263.github.io/> \"https://knqyf263.github.io\" ) . \n\n \n \n $ yum remove trivy\n $ sed -i s/knqyf263/aquasecurity/g /etc/yum.repos.d/trivy.repo\n $ yum update\n $ yum install trivy\n\n \n** Debian/Ubuntu ** \nUse [ https://aquasecurity.github.io ](<https://aquasecurity.github.io/> \"https://aquasecurity.github.io\" ) instead of [ https://knqyf263.github.io ](<https://knqyf263.github.io/> \"https://knqyf263.github.io\" ) . \n\n \n \n $ apt-get remove --purge trivy\n $ sed -i s/knqyf263/aquasecurity/g /etc/apt/sources.list.d/trivy.list\n $ apt-get update\n $ apt-get install trivy\n\n \n** Homebrew ** \nTap aquasecurity/trivy \n\n \n \n $ brew uninstall --force trivy\n $ brew untap knqyf263/trivy\n $ brew install aquasecurity/trivy/trivy\n\n \n** Binary (Including Windows) ** \nNo need to fix. \n \n** Others ** \n \n** Detected version update of trivy. Please try again with --refresh option ** \nTry again with ` --refresh ` option: \n\n \n \n $ trivy --refresh alpine:3.9\n\n \n** Unknown error ** \nTry again with ` --reset ` option: \n\n \n \n $ trivy --reset\n\n \n** Credits ** \n\n\n * Special thanks to [ Tomoya Amachi ](<https://github.com/tomoyamachi> \"Tomoya Amachi\" )\n * Special thanks to [ Masahiro Fujimura ](<https://github.com/masahiro331> \"Masahiro Fujimura\" )\n * Special thanks to [ Naoki Harima ](<https://github.com/XapiMa> \"Naoki Harima\" )\n \n** Author ** \nTeppei Fukuda (knqyf263) \n \n \n\n\n** [ Download Trivy ](<https://github.com/aquasecurity/trivy> \"Download Trivy\" ) **\n", "edition": 212, "modified": "2019-11-05T12:00:00", "published": "2019-11-05T12:00:00", "id": "KITPLOIT:7323577050718865961", "href": "http://www.kitploit.com/2019/11/trivy-simple-and-comprehensive.html", "title": "Trivy - A Simple And Comprehensive Vulnerability Scanner For Containers, Suitable For CI", "type": "kitploit", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}]}
