Test ID:	1.3.6.1.4.1.25623.1.1.2.2019.2519
Category:	Huawei EulerOS Local Security Checks
Title:	Huawei EulerOS: Security Advisory for libxslt (EulerOS-SA-2019-2519)
Summary:	The remote host is missing an update for the Huawei EulerOS 'libxslt' package(s) announced via the EulerOS-SA-2019-2519 advisory.
Description:	Summary: The remote host is missing an update for the Huawei EulerOS 'libxslt' package(s) announced via the EulerOS-SA-2019-2519 advisory. Vulnerability Insight: In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed.(CVE-2019-18197) The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not check if the parent node is an element, which allows attackers to cause a denial of service via a crafted XML file, related to a 'type confusion' issue.(CVE-2015-7995) numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles namespace nodes, which allows remote attackers to cause a denial of service (out-of-bounds heap memory access) or possibly have unspecified other impact via a crafted document.(CVE-2016-1683) numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles the i format token for xsl:number data, which allows remote attackers to cause a denial of service (integer overflow or resource consumption) or possibly have unspecified other impact via a crafted document.(CVE-2016-1684) libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4608, CVE-2016-4609, CVE-2016-4610, and CVE-2016-4612.(CVE-2016-4607) libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4607, CVE-2016-4609, CVE-2016-4610, and CVE-2016-4612.(CVE-2016-4608) libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4607, CVE-2016-4608, CVE-2016-4610, and CVE-2016-4612.(CVE-2016-4609) libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4607, CVE-2016-4608, CVE-2016-4609, and CVE-2016-4612.(CVE-2016-4610) ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-1683. Reason: This candidate is a ... [Please see the references for more information on the vulnerabilities] Affected Software/OS: 'libxslt' package(s) on Huawei EulerOS V2.0SP2. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-7995 http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.html http://lists.apple.com/archives/security-announce/2016/Jan/msg00003.html http://lists.apple.com/archives/security-announce/2016/Jan/msg00005.html http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html BugTraq ID: 77325 http://www.securityfocus.com/bid/77325 Debian Security Information: DSA-3605 (Google Search) http://www.debian.org/security/2016/dsa-3605 http://www.openwall.com/lists/oss-security/2015/10/27/10 http://www.openwall.com/lists/oss-security/2015/10/28/4 http://www.securitytracker.com/id/1034736 http://www.securitytracker.com/id/1038623 http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.386546 SuSE Security Announcement: openSUSE-SU-2016:1439 (Google Search) http://lists.opensuse.org/opensuse-updates/2016-05/msg00123.html Common Vulnerability Exposure (CVE) ID: CVE-2016-1683 http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html BugTraq ID: 90876 http://www.securityfocus.com/bid/90876 BugTraq ID: 91826 http://www.securityfocus.com/bid/91826 Debian Security Information: DSA-3590 (Google Search) http://www.debian.org/security/2016/dsa-3590 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/ https://security.gentoo.org/glsa/201607-07 RedHat Security Advisories: RHSA-2016:1190 https://access.redhat.com/errata/RHSA-2016:1190 http://www.securitytracker.com/id/1035981 SuSE Security Announcement: openSUSE-SU-2016:1430 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html SuSE Security Announcement: openSUSE-SU-2016:1433 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html SuSE Security Announcement: openSUSE-SU-2016:1496 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00005.html http://www.ubuntu.com/usn/USN-2992-1 Common Vulnerability Exposure (CVE) ID: CVE-2016-1684 Common Vulnerability Exposure (CVE) ID: CVE-2016-4607 BugTraq ID: 91834 http://www.securityfocus.com/bid/91834 http://www.securitytracker.com/id/1036348 Common Vulnerability Exposure (CVE) ID: CVE-2016-4608 Common Vulnerability Exposure (CVE) ID: CVE-2016-4609 https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html Common Vulnerability Exposure (CVE) ID: CVE-2016-4610 Common Vulnerability Exposure (CVE) ID: CVE-2016-4612
Copyright	Copyright (C) 2020 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.