SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2018:3081-1)

This update for libxml2 fixes the following security issues : CVE-2018-9251: The xzdecomp function allowed remote attackers to cause a denial of service infinite loop via a crafted XML file that triggers LZMAMEMLIMITERROR, as demonstrated by xmllint bsc1088279. CVE-2018-14567: Prevent denial of...

SUSE-SU-2018:3080-1 Security update for libxml2

This update for libxml2 fixes the following security issues: - CVE-2018-9251: The xzdecomp function allowed remote attackers to cause a denial of service infinite loop via a crafted XML file that triggers LZMAMEMLIMITERROR, as demonstrated by xmllint bsc1088279 - CVE-2018-14567: Prevent denial of...

SUSE-SU-2018:3081-1 Security update for libxml2

This update for libxml2 fixes the following security issues: - CVE-2018-9251: The xzdecomp function allowed remote attackers to cause a denial of service infinite loop via a crafted XML file that triggers LZMAMEMLIMITERROR, as demonstrated by xmllint bsc1088279. - CVE-2018-14567: Prevent denial o...

Nokogiri gem, via libxml2, is affected by multiple vulnerabilities

Nokogiri 1.8.5 has been released. This is a security and bugfix release. It addresses two CVEs in upstream libxml2 rated as "medium" by Red Hat, for which details are below. If you're using your distro's system libraries, rather than Nokogiri's vendored libraries, there's no security need to...

[ASA-201810-4] lib32-libxml2: denial of service

Arch Linux Security Advisory ASA-201810-4 ========================================= Severity: Medium Date : 2018-10-01 CVE-ID : CVE-2018-9251 Package : lib32-libxml2 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-673 Summary ======= The package lib32-libxml2 befor...

[ASA-201810-3] libxml2: denial of service

Arch Linux Security Advisory ASA-201810-3 ========================================= Severity: Medium Date : 2018-10-01 CVE-ID : CVE-2018-9251 Package : libxml2 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-672 Summary ======= The package libxml2 before version...

Debian DLA-1524-1 : libxml2 security update

CVE-2018-14404 Fix of a NULL pointer dereference which might result in a crash and thus in a denial of service. CVE-2018-14567 and CVE-2018-9251 Approvement in LZMA error handling which prevents an infinite loop. CVE-2017-18258 Limit available memory to 100MB to avoid exhaustive memory consumptio...

[SECURITY] [DLA 1524-1] libxml2 security update

Package : libxml2 Version : 2.9.1+dfsg1-5+deb8u7 CVE ID : CVE-2017-18258 CVE-2018-9251 CVE-2018-14404 CVE-2018-14567 CVE-2018-14404 Fix of a NULL pointer dereference which might result in a crash and thus in a denial of service. CVE-2018-14567 and CVE-2018-9251 Approvement in LZMA error handling...

Debian: Security Advisory (DLA-1524-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DLA-1524-1 libxml2 - security update

Bulletin has no description...

EulerOS Virtualization 2.5.1 : libxml2 (EulerOS-SA-2018-1257)

According to the versions of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary co...

EulerOS Virtualization 2.5.0 : libxml2 (EulerOS-SA-2018-1255)

According to the version of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products,...

EulerOS Virtualization 2.5.0 : libxml2 (EulerOS-SA-2018-1258)

According to the versions of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary co...

Heap-based buffer overflow in nokogiri

Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially...

GHSA-JXJR-5H69-QW3W Heap-based buffer overflow in nokogiri

Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially...

GHSA-7HP2-XWPJ-95JQ Denial of service or RCE from libxml2 and libxslt

Nokogiri is affected by series of vulnerabilities in libxml2 and libxslt, which are libraries Nokogiri depends on. It was discovered that libxml2 and libxslt incorrectly handled certain malformed documents, which can allow malicious users to cause issues ranging from denial of service to remote...

Denial of service or RCE from libxml2 and libxslt

Nokogiri is affected by series of vulnerabilities in libxml2 and libxslt, which are libraries Nokogiri depends on. It was discovered that libxml2 and libxslt incorrectly handled certain malformed documents, which can allow malicious users to cause issues ranging from denial of service to remote...

libxml2/libxml2_xml_read_memory_fuzzer: Heap-use-after-free in xmlSAX2AttributeNs

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed report: https://oss-fuzz.com/testcase?key=5721921484750848 Project: libxml2 Fuzzer: libFuzzerlibxml2xmlreadmemoryfuzzer Fuzz target binary: libxml2xmlreadmemoryfuzzer Job Type: libfuzzerasanlibxml2 Platform Id: linux Crash Type:...

USN-3739-1: libxml2 vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description Matias Brutti discovered that libxml2 incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information...

Amazon Linux AMI : libxml2 (ALAS-2018-1072)

A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval function of libxml2 when parsing invalid XPath expression. Applications processing untrusted XSL format inputs with the use of libxml2 library may be vulnerable to denial of service attack due to crash of the...