Debian DLA-1188-1 : libxml2 security update

Pranjal Jumde @pjumde reported an heap overflow in memory debug code of libxml2. For Debian 7 'Wheezy', these problems have been fixed in version 2.8.0+dfsg1-7+wheezy10. We recommend that you upgrade your libxml2 packages. NOTE: Tenable Network Security has extracted the preceding description blo...

CVE-2017-16932

parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities...

CVE-2017-16931

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name...

libxml2 parser.c File Denial of Service Vulnerability

libxml2 is the GNOME project team developed a C-based library for parsing XML documents, which supports multiple encoding formats, Xpath parsing, Well-formed and valid validation. A denial of service vulnerability exists in the parser.c file in versions of libxml2 prior to 2.9.5, which stems from...

Copy-paste Vulnerability Through LibXML2

Nokogiri and chef are vulnerable to attacks through a copied version of LibXML2 within the codebase. LibXML2 before 2.9.5 is vulnerable to the following CVEs: 1 CVE-2017-16931 - LibXML2 incorrectly handles parameter-entity references in parser.c. 2 CVE-2017-16932 - LibXML2 can enter an infinite...

CVE-2017-16932

parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities...

CVE-2017-16931

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name...

CVE-2017-16931

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name...

DEBIAN-CVE-2017-16932

parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities...

CVE-2017-16932

parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities...

ALPINE-CVE-2017-16931

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name...

Code injection

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name...

CVE-2017-16931

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name...

DEBIAN-CVE-2017-16931

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name...

[SECURITY] [DLA 1188-1] libxml2 security update

Package : libxml2 Version : 2.8.0+dfsg1-7+wheezy10 CVE ID : CVE-2017-5130 Pranjal Jumde @pjumde reported an heap overflow in memory debug code of libxml2. For Debian 7 "Wheezy", these problems have been fixed in version 2.8.0+dfsg1-7+wheezy10. We recommend that you upgrade your libxml2 packages...

CVE-2017-16931

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name...

CVE-2017-16931

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name...

CVE-2017-16932

parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities...

CVE-2017-16931

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name...

CVE-2017-16931

CVE-2017-16931 affects libxml2 (parser.c) prior to version 2.9.5, where parameter-entity references are mishandled: the NEXTL macro calls xmlParserHandlePEReference for a '%' in a DTD name, enabling a buffer overflow and potential remote code execution. The connected details confirm the vulnerabl...