7337 matches found
libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.
A flaw in libxml2's XInclude processing xmlXIncludeProcess and xmlXIncludeProcessTree fails to propagate parser flags like XMLPARSENONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery SSRF, XML External Entity XXE...
libxml2: libxml2: Denial of Service via out-of-bounds read in xmlFAParsePosCharGroup
A flaw was found in libxml2. This out-of-bounds read vulnerability, specifically within the xmlFAParsePosCharGroup function, could allow an attacker to cause a denial of service. By processing specially crafted XML input, the affected component may attempt to read data beyond its allocated memory...
libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks
An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity...
libxml2: double-free/UAF in libxml2 Python bindings
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition DTD with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callbac...
libxml2: libxml2: Denial of Service due to NULL pointer dereference in xmlRegNewParserCtxt
A NULL pointer dereference in libxml2's xmlRegNewParserCtxt function allows a local attacker to cause a denial of service DoS. The flaw occurs when strlen is called on an unverified pointer following a failed xmlStrdup memory allocation, resulting in a process crash...
libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation
A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure,...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: libxml2: libxml2-16-2.15.4-0.1.hum1 aarch64, x8664 libxml2-2.15.4-0.1.hum1 aarch64, x8664 libxml2-devel-2.15.4-0.1.hum1 aarch64, x8664 libxml2-static-2.15.4-0.1.hum1 aarch64, x8664...
CVE-2016-3627
CVE-2016-3627 Usage: xmllint --valid --recover CVE-2016-3627.xml root@kitploit: xxd CVE-2016-3627.xml 00000000: 3c21 444f 4354 5950 455b 3c21 454e 5449 0... S="&Y 00000030: 4e3b N;...
CVE-2026-86142
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation...
AZL-99705 CVE-2026-86143 affecting package libxml2 2.11.5-10
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...
CVE-2026-86141
xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking...
CVE-2026-86143
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...
AZL-99708 CVE-2026-86141 affecting package libxml2 2.11.5-10
xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking...
AZL-99720 CVE-2026-86142 affecting package libxml2 2.11.5-10
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation...
AZL-99702 CVE-2026-86144 affecting package libxml2 2.11.5-10
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...
CVE-2026-86144
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...
AZL-99711 CVE-2026-86138 affecting package libxml2 2.11.5-10
In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow...
CVE-2026-86139
In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow...