Important Photon OS Security Update - PHSA-2023-5.0-91-0119

Updates of 'vim', 'libxml2' packages of Photon OS have been released...

SUSE-SU-2023:3666-2 Security update for libxml2

This update for libxml2 fixes the following issues: - CVE-2023-39615: Fixed crafted xml can cause global buffer overflow bsc1214768...

Security Bulletin: Security Vulnerabilities fixed in IBM Security Verify Access (CVE-2022-40303)

Summary A Security Vulnerability in libxml2 as shipped with IBM Security Verify Access has been fixed. Vulnerability Details CVEID:CVE-2022-40303 DESCRIPTION: Gnome libxml2 could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in the XMLPARSEHUGE...

ROS-20231013-03

A vulnerability in the xmlUnlinkNode function in the tree.c file of the libxml2 library is related to a failure of a specific allocated memory. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

SUSE CVE-2023-45322

libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when...

Security Bulletin: AIX is vulnerable to a denial of service due to libxml2 (CVE-2023-29469 and CVE-2023-28484)

Summary Vulnerabilities in libxml2 could allow a remote attacker to cause a denial of service CVE-2023-29469 and CVE-2023-28484. AIX uses libxml2 as part of its XML parsing functions. Vulnerability Details CVEID:CVE-2023-29469 DESCRIPTION: GNOME libxml2 is vulnerable to a denial of service, cause...

libxml2:xml: Heap-use-after-free in xmlParserPrintFileContextInternal

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=5128529790238720 Project: libxml2 Fuzzing Engine: libFuzzer Fuzz Target: xml Job Type: libfuzzerasanlibxml2 Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0x62500001190...

CVE-2023-45322

A flaw was found in libxml2. In an out-of-memory condition or when limiting the memory allocation, processing a XML document using the HTML parser may result in a use-after-free vulnerability...

PT-2023-36071

Name of the Vulnerable Software and Affected Versions libxml2 affected versions not specified Description The issue is related to a heap buffer overflow error. Technical details about the error include the crash type being a Heap-buffer-overflow WRITE 1. The crash state involves several function...

libxml2:schema: Heap-buffer-overflow in xmlParseCommentComplex

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=6748213765603328 Project: libxml2 Fuzzing Engine: afl Fuzz Target: schema Job Type: aflasanlibxml2 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x6020000009b4 Crash...

libxml2:valid: Heap-use-after-free in __xmlRaiseError

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=6379135095930880 Project: libxml2 Fuzzing Engine: afl Fuzz Target: valid Job Type: aflasanlibxml2 Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x60c000002388 Crash...

PT-2023-36066 · Git +1 · Libxml2

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow crash. Technical details about the crash include the xmlCopyCharMultiByte, xmlParseCommentComplex, and...

libxml2:xpath: Heap-buffer-overflow in xmlCopyCharMultiByte

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=5952232040038400 Project: libxml2 Fuzzing Engine: afl Fuzz Target: xpath Job Type: aflasanlibxml2 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x6020000001b4 Crash...

libxml2:schema: Use-of-uninitialized-value in xmlStrdup

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=5789723798667264 Project: libxml2 Fuzzing Engine: libFuzzer Fuzz Target: schema Job Type: libfuzzermsanlibxml2 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash Stat...

libprotobuf-mutator:libxml2_example: Heap-buffer-overflow in xmlParseCommentComplex

Project: https://github.com/google/libprotobuf-mutator.git Detailed Report: https://oss-fuzz.com/testcase?key=4988342930112512 Project: libprotobuf-mutator Fuzzing Engine: libFuzzer Fuzz Target: libxml2example Job Type: libfuzzerasanlibprotobuf-mutator Platform Id: linux Crash Type:...

libxml2 security update

An update is available for libxml2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libxml2 library is a development toolbox providing the implementation of...

RLSA-2023:4529 Moderate: libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: NULL dereference in xmlSchemaFixupComplexType CVE-2023-28484 libxml2: Hashing of empty dict strings isn't deterministic CVE-2023-29469 For more details about the security...

CVE-2023-45322

libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when...

AZL-31272 CVE-2023-45322 affecting package libxml2 for versions less than 2.10.4-2

libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when...

AZL-34960 CVE-2023-45322 affecting package libxml2 for versions less than 2.11.5-3

libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when...