The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2193:02 advisory.

    * libxml2: Use-after-free in xmlEncodeEntitiesInternal() in entities.c (CVE-2021-3516)
      * libxml2: Heap-based buffer overflow in xmlEncodeEntitiesInternal() in entities.c (CVE-2021-3517)
      * libxml2: Use-after-free in xmlXIncludeDoProcess() in xinclude.c (CVE-2021-3518)
      * libxml2: NULL pointer dereference when post-validating mixed content parsed in recovery mode     (CVE-2021-3537)
      * libxml2: Exponential entity expansion attack bypasses all existing protection mechanisms     (CVE-2021-3541)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0455 advisory.

    This advisory aggregates security fixes for the libxml2 SRPM in CIQ LTS 9.2. It addresses 30 CVEs:
    CVE-2022-40304, CVE-2015-7499, CVE-2015-7942, CVE-2008-4225, CVE-2015-7497, and 25 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the libxml2 package has been released.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14729-1 advisory.

  - The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in     Oracle HTTP Server in Oracle Fusion Middleware 11.1.1.7.0, 12.1.2.0, and 12.1.3.0 and other products,     loads external parameter entities regardless of whether entity substitution or validation is enabled,     which allows remote attackers to cause a denial of service (resource consumption) via a crafted XML     document. (CVE-2014-0191)

  - xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to     newDoc->oldNs. (CVE-2019-19956)

  - xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
    (CVE-2019-20388)

  - GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at     libxml2/entities.c. The issue has been fixed in commit 50f06b3e. (CVE-2020-24977)

  - xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file     situation. (CVE-2020-7595)

  - There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted     file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to     confidentiality, integrity, and availability. (CVE-2021-3516)

  - There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker     who is able to supply a crafted file to be processed by an application linked with the affected     functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to     application availability, with some potential impact to confidentiality and integrity if an attacker is     able to use memory information to further exploit the application. (CVE-2021-3517)

  - There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to     be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact     from this flaw is to confidentiality, integrity, and availability. (CVE-2021-3518)

  - A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while     parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery     mode and post-validated, the flaw could be used to crash the application. The highest threat from this     vulnerability is to system availability. (CVE-2021-3537)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libxml2 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability found in libxml2 in versions before     2.9.11 shows that it did not propagate errors while     parsing XML mixed content, causing a NULL dereference.
    If an untrusted XML document was parsed in recovery     mode and post-validated, the flaw could be used to     crash the application. The highest threat from this     vulnerability is to system availability.(CVE-2021-3537)

  - There's a flaw in libxml2. An attacker who is able to     submit a crafted file to be processed by an application     linked with libxml2 could trigger a use-after-free. The     greatest impact from this flaw is to confidentiality,     integrity, and availability.(CVE-2021-3518)

  - There is a flaw in the xml entity encoding     functionality of libxml2. An attacker who is able to     supply a crafted file to be processed by an application     linked with the affected functionality of libxml2 could     trigger an out-of-bounds read. The most likely impact     of this flaw is to application availability, with some     potential impact to confidentiality and integrity if an     attacker is able to use memory information to further     exploit the application.(CVE-2021-3517)

  - This library allows to manipulate XML files. It     includes supportto read, modify and write XML and HTML     files. There is DTDs supportthis includes parsing and     validation even with complex DtDs, eitherat parse time     or later once the document has been modified. The     outputcan be a simple SAX stream or an(CVE-2021-3541)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:2569 advisory.

  - libxml2: Use-after-free in xmlEncodeEntitiesInternal() in entities.c (CVE-2021-3516)

  - libxml2: Heap-based buffer overflow in xmlEncodeEntitiesInternal() in entities.c (CVE-2021-3517)

  - libxml2: Use-after-free in xmlXIncludeDoProcess() in xinclude.c (CVE-2021-3518)

  - libxml2: NULL pointer dereference when post-validating mixed content parsed in recovery mode     (CVE-2021-3537)

  - libxml2: Exponential entity expansion attack bypasses all existing protection mechanisms (CVE-2021-3541)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - This library allows to manipulate XML files. It     includes supportto read, modify and write XML and HTML     files. There is DTDs supportthis includes parsing and     validation even with complex DtDs, eitherat parse time     or later once the document has been modified. The     outputcan be a simple SAX stream or an(CVE-2021-3541)

  - There's a flaw in libxml2's xmllint. An attacker who is     able to submit a crafted file to be processed by     xmllint could trigger a use-after-free. The greatest     impact of this flaw is to confidentiality, integrity,     and availability.(CVE-2021-3516)

  - There is a flaw in the xml entity encoding     functionality of libxml2. An attacker who is able to     supply a crafted file to be processed by an application     linked with the affected functionality of libxml2 could     trigger an out-of-bounds read. The most likely impact     of this flaw is to application availability, with some     potential impact to confidentiality and integrity if an     attacker is able to use memory information to further     exploit the application.(CVE-2021-3517)

  - There's a flaw in libxml2 in versions before 2.9.11. An     attacker who is able to submit a crafted file to be     processed by an application linked with libxml2 could     trigger a use-after-free. The greatest impact from this     flaw is to confidentiality, integrity, and     availability.(CVE-2021-3518)

  - A vulnerability found in libxml2 in versions before     2.9.11 shows that it did not propagate errors while     parsing XML mixed content, causing a NULL dereference.
    If an untrusted XML document was parsed in recovery     mode and post-validated, the flaw could be used to     crash the application. The highest threat from this     vulnerability is to system availability.(CVE-2021-3537)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2021_2569 advisory.

    * libxml2: Use-after-free in xmlEncodeEntitiesInternal() in entities.c (CVE-2021-3516)

    * libxml2: Heap-based buffer overflow in xmlEncodeEntitiesInternal() in entities.c (CVE-2021-3517)

    * libxml2: Use-after-free in xmlXIncludeDoProcess() in xinclude.c (CVE-2021-3518)

    * libxml2: NULL pointer dereference when post-validating mixed content parsed in recovery mode     (CVE-2021-3537)

    * libxml2: Exponential entity expansion attack bypasses all existing protection mechanisms (CVE-2021-3541)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.4.0.0 versions of Enterprise Manager Ops Center installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory.

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component:     Networking (Apache HTTP Server)). The supported version that is affected is 12.4.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise     Manager Ops Center. Successful attacks of this vulnerability can result in takeover of Enterprise     Manager Ops Center. (CVE-2021-26691)

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component: Guest     Management (libxml2)). The supported version that is affected is 12.4.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise     Manager Ops Center. Successful attacks require human interaction from a person other than the attacker.
    Successful attacks of this vulnerability can result in takeover of Enterprise Manager Ops Center.
    (CVE-2021-3518)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle MySQL Workbench installed on the remote Windows host is prior to 8.0.27. It is, therefore, affected by multiple vulnerabilities as referenced in the advisory.

  - Vulnerability in the MySQL Workbench product of Oracle MySQL (component: MySQL Workbench (OpenSSL)). Supported     versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via MySQL Workbench to compromise MySQL Workbench.  Successful attacks of this     vulnerability can result in unauthorized access to critical data or complete access to all MySQL Workbench     accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL     Workbench. (CVE-2021-3712)

  - Vulnerability in the MySQL Workbench product of Oracle MySQL (component: MySQL Workbench (libxml2)). Supported     versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows unauthenticated attacker     with network access via MySQL Workbench to compromise MySQL Workbench.  Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL     Workbench. (CVE-2021-3518)

  - Vulnerability in the MySQL Workbench product of Oracle MySQL (component: MySQL Workbench (OpenSSL)). Supported     versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via MySQL Workbench to compromise MySQL Workbench. Successful attacks of this vulnerability     can result in unauthorized access to critical data or complete access to all MySQL Workbench accessible data and     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Workbench

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
291696	MiracleLinux 8 : libxml2-2.9.7-9.el8.2 (AXSA:2021-2193:02)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	high
357297	Rocky Linux 9.2 [CIQ] Security Update: libxml2 / libxml2-debuginfo / libxml2-debugsource / libxml2-devel / etc Multiple Vulnerabilities (ciqsa-2026_0455)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	high
333910	Photon OS 5.0: Libxml2 PHSA-2026-5.0-91-0874	Nessus	PhotonOS Local Security Checks	2026/8/10	2026/11/2	medium
150579	SUSE SLES11 Security Update : libxml2 (SUSE-SU-2021:14729-1)	Nessus	SuSE Local Security Checks	2021/6/10	2023/12/26	high
151303	EulerOS Virtualization for ARM 64 3.0.2.0 : libxml2 (EulerOS-SA-2021-2103)	Nessus	Huawei Local Security Checks	2021/7/2	2023/12/11	high
151363	CentOS 8 : libxml2 (CESA-2021:2569)	Nessus	CentOS Local Security Checks	2021/7/3	2023/12/11	high
152408	EulerOS 2.0 SP8 : libxml2 (EulerOS-SA-2021-2306)	Nessus	Huawei Local Security Checks	2021/8/10	2023/12/4	high
358032	Rocky Linux 8 [CIQ] Security Update: libxml2 / libxml2-debuginfo / libxml2-debugsource / libxml2-devel / etc Multiple Vulnerabilities (crlsa-2021_2569)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
170202	Oracle Enterprise Manager Ops Center UCE Patches (Oct 2021 CPU)	Nessus	Misc.	2023/1/20	2023/1/23	critical
154655	Oracle MySQL Workbench < 8.0.27 Multiple Vulnerabilities (Oct 2021)	Nessus	Windows	2021/10/28	2023/11/27	high

検出

プラグインの検索

high

high

medium

high

high

high

high

high

critical

high