logo
DATABASE RESOURCES PRICING ABOUT US

Nokogiri does not forbid namespace nodes in XPointer ranges

Description

xpointer.c in libxml2 before 2.9.5 (as used in nokogiri before 1.7.1 amongst other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.


Affected Software


CPE Name Name Version
nokogiri 1.7.1

Related