The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-545:01 advisory.

    This library allows to manipulate XML files. It includes support     to read, modify and write XML and HTML files. There is DTDs support     this includes parsing and validation even with complex DtDs, either     at parse time or later once the document has been modified. The output     can be a simple SAX stream or and in-memory DOM like representations.
    In this case one can use the built-in XPath and XPointer implementation     to select sub nodes or ranges. A flexible Input/Output mechanism is     available, with existing HTTP and FTP modules and combined to an     URI library.
    Security issues fixed with this release:
    CVE-2016-1762     libxml2 in Apple iOS before 9.3, OS X before 10.11.4, Safari before     9.1, tvOS before 9.2, and watchOS before 2.2 allows remote attackers     to execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document.
    CVE-2016-1833     libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS     before 9.2.1, and watchOS before 2.2.1, allows remote attackers to     execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document, a different vulnerability than     CVE-2016-1834, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838,     CVE-2016-1839, and CVE-2016-1840.
    CVE-2016-1834     libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS     before 9.2.1, and watchOS before 2.2.1, allows remote attackers to     execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document, a different vulnerability than     CVE-2016-1833, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838,     CVE-2016-1839, and CVE-2016-1840.
    CVE-2016-1835     libxml2, as used in Apple iOS before 9.3.2 and OS X before 10.11.5,     allows remote attackers to execute arbitrary code or cause a denial of     service (memory corruption) via a crafted XML document.
    CVE-2016-1836     libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS     before 9.2.1, and watchOS before 2.2.1, allows remote attackers to     execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document, a different vulnerability than     CVE-2016-1833, CVE-2016-1834, CVE-2016-1837, CVE-2016-1838,     CVE-2016-1839, and CVE-2016-1840.
    CVE-2016-1837     libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS     before 9.2.1, and watchOS before 2.2.1, allows remote attackers to     execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document, a different vulnerability than     CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1838,     CVE-2016-1839, and CVE-2016-1840.
    CVE-2016-1838     libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS     before 9.2.1, and watchOS before 2.2.1, allows remote attackers to     execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document, a different vulnerability than     CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1837,     CVE-2016-1839, and CVE-2016-1840.
    CVE-2016-1839     libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS     before 9.2.1, and watchOS before 2.2.1, allows remote attackers to     execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document, a different vulnerability than     CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1837,     CVE-2016-1838, and CVE-2016-1840.
    CVE-2016-1840     libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS     before 9.2.1, and watchOS before 2.2.1, allows remote attackers to     execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document, a different vulnerability than     CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1837,     CVE-2016-1838, and CVE-2016-1839.
    CVE-2016-3627     The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and     earlier, when used in recovery mode, allows context-dependent     attackers to cause a denial of service (infinite recursion, stack     consumption, and application crash) via a crafted XML document.
    CVE-2016-3705     The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions     in parser.c in libxml2 2.9.3 do not properly keep track of the     recursion depth, which allows context-dependent attackers to cause a     denial of service (stack consumption and application crash) via a     crafted XML document containing a large number of nested entity     references.
    CVE-2016-4447     The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4     allows context-dependent attackers to cause a denial of service     (heap-based buffer underread and application crash) via a crafted     file, involving xmlParseName.
    CVE-2016-4448     Format string vulnerability in libxml2 before 2.9.4 allows attackers     to have unspecified impact via format string specifiers in unknown     vectors.
    CVE-2016-4449     XML external entity (XXE) vulnerability in the     xmlStringLenDecodeEntities function in parser.c in libxml2 before     2.9.4, when not in validating mode, allows context-dependent attackers     to read arbitrary files or cause a denial of service (resource     consumption) via unspecified vectors.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to latest upstream release, includes several security related fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-37 (libxml2: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libxml2. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user or automated system to process a       specially crafted XML document, possibly resulting in execution of       arbitrary code with the privileges of the process or a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.(CVE-2016-1838)

The mobile device is running a version of iOS prior to 9.3.2. It is, therefore, affected by multiple vulnerabilities in the following components :

  - Accessibility
  - CFNetwork Proxies
  - CommonCrypto
  - CoreCapture
  - Disk Images
  - ImageIO
  - IOAcceleratorFamily
  - IOHIDFamily
  - Kernel
  - libc
  - libxml2
  - libxslt
  - MapKit
  - OpenGL
  - Safari
  - Siri
  - WebKit
  - WebKit Canvas

The remote host is running a version of Mac OS X that is 10.9.5 or 10.10.5 and is missing Security Update 2016-003. It is, therefore, affected by multiple vulnerabilities in the following components :

  - AMD
  - Captive Network Assistant
  - libxml2
  - libxslt
  - OpenGL

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Several vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause a denial of service against the application, or potentially the execution of arbitrary code with the privileges of the user running the application.

For Debian 7 'Wheezy', these problems have been fixed in version 2.8.0+dfsg1-7+wheezy6.

We recommend that you upgrade your libxml2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Update doc/redhat.gif in tarball

  - Add libxml2-oracle-enterprise.patch and update logos in     tarball

  - Heap-based buffer overread in xmlNextChar     (CVE-2016-1762)

  - Bug 763071: Heap-buffer-overflow in xmlStrncat     (CVE-2016-1834)

  - Bug 757711: Heap-buffer-overflow in     xmlFAParsePosCharGroup (CVE-2016-1840)

  - Bug 758588: Heap-based buffer overread in     xmlParserPrintFileContextInternal (CVE-2016-1838)

  - Bug 758605: Heap-based buffer overread in     xmlDictAddString (CVE-2016-1839)

  - Bug 759398: Heap use-after-free in xmlDictComputeFastKey     (CVE-2016-1836)

  - Fix inappropriate fetch of entities content     (CVE-2016-4449)

  - Heap use-after-free in htmlParsePubidLiteral and     htmlParseSystemiteral (CVE-2016-1837)

  - Heap use-after-free in xmlSAX2AttributeNs     (CVE-2016-1835)

  - Heap-based buffer-underreads due to xmlParseName     (CVE-2016-4447)

  - Heap-based buffer overread in htmlCurrentChar     (CVE-2016-1833)

  - Add missing increments of recursion depth counter to XML     parser. (CVE-2016-3705)

  - Avoid building recursive entities (CVE-2016-3627)

  - Fix some format string warnings with possible format     string vulnerability (CVE-2016-4448)

  - More format string warnings with possible format string     vulnerability (CVE-2016-4448)

  - Fix large parse of file from memory (rhbz#862969)

A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an application linked against libxml2, would cause the application to crash or execute arbitrary code with the permissions of the user running the application.
(CVE-2016-1834 , CVE-2016-1840)

Multiple denial of service flaws were found in libxml2. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, could cause that application to crash. (CVE-2016-1762 , CVE-2016-1833 , CVE-2016-1835 , CVE-2016-1836 , CVE-2016-1837 , CVE-2016-1838 , CVE-2016-1839 , CVE-2016-3627 , CVE-2016-3705 , CVE-2016-4447 , CVE-2016-4448 , CVE-2016-4449)

Daniel Veillard reports :

More format string warnings with possible format string vulnerability (David Kilzer)

Avoid building recursive entities (Daniel Veillard)

Heap-based buffer overread in htmlCurrentChar (Pranjal Jumde)

Heap-based buffer-underreads due to xmlParseName (David Kilzer)

Heap use-after-free in xmlSAX2AttributeNs (Pranjal Jumde)

Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral (Pranjal Jumde)

Fix some format string warnings with possible format string vulnerability (David Kilzer)

Detect change of encoding when parsing HTML names (Hugh Davenport)

Fix inappropriate fetch of entities content (Daniel Veillard)

Bug 759398: Heap use-after-free in xmlDictComputeFastKey (Pranjal Jumde)

Bug 758605: Heap-based buffer overread in xmlDictAddString (Pranjal Jumde)

Bug 758588: Heap-based buffer overread in xmlParserPrintFileContextInternal (David Kilzer)

Bug 757711: heap-buffer-overflow in xmlFAParsePosCharGroup (Pranjal Jumde)

Add missing increments of recursion depth counter to XML parser.
(Peter Simons)

Fix NULL pointer deref in XPointer range-to

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2,     OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a     denial of service (heap-based buffer over-read) via a crafted XML document. (CVE-2016-1838)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
289699	MiracleLinux 7 : libxml2-2.9.1-6.0.1.el7.AXS7.3 (AXSA:2016-545:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
99491	Fedora 25 : libxml2 (2017-a3a47973eb)	Nessus	Fedora Local Security Checks	2017/4/20	2025/12/25	critical
99492	Fedora 24 : libxml2 (2017-be8574d593)	Nessus	Fedora Local Security Checks	2017/4/20	2025/12/25	critical
96541	GLSA-201701-37 : libxml2: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/1/17	2026/1/5	critical
95968	F5 Networks BIG-IP : libxml2 vulnerability (K71926235)	Nessus	F5 Networks Local Security Checks	2016/12/21	2026/1/7	medium
91225	Apple iOS < 9.3.2 Multiple Vulnerabilities	Nessus	Mobile Devices	2016/5/18	2026/8/10	high
91229	Mac OS X 10.9.5 / 10.10.5 Multiple Vulnerabilities (Security Update 2016-003)	Nessus	MacOS X Local Security Checks	2016/5/19	2024/5/28	high
91472	Debian DLA-503-1 : libxml2 security update	Nessus	Debian Local Security Checks	2016/6/6	2021/1/11	high
91800	OracleVM 3.3 / 3.4 : libxml2 (OVMSA-2016-0087)	Nessus	OracleVM Local Security Checks	2016/6/24	2021/1/4	critical
92221	Amazon Linux AMI : libxml2 (ALAS-2016-719)	Nessus	Amazon Linux Local Security Checks	2016/7/15	2026/2/2	critical
93145	FreeBSD : libxml2 -- multiple vulnerabilities (e195679d-045b-4953-bb33-be0073ba2ac6)	Nessus	FreeBSD Local Security Checks	2016/8/29	2026/1/28	high
219299	Linux Distros Unpatched Vulnerability : CVE-2016-1838	Nessus	Misc.	2025/3/4	2026/1/28	medium

検出

プラグインの検索

critical

critical

critical

critical

medium

high

high

high

critical

critical

high

medium