7865 matches found
CVE-2026-86138
In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow...
CVE-2026-86138
In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow...
CVE-2026-86138
In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow...
Out-of-bounds Write
Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the xmlDictAddQString function in dict.c due to an integer overflow that leads to a heap-based buffer overflow. An attacker can execute arbitrary code by supplying specially crafted input that triggers the overflo...
EUVD-2026-71830
In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp...
CVE-2026-86137
In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp...
CVE-2026-86137
libxml2 before version 2.15.4 contains an out-of-bounds read in the xmlFAParsePosCharGroup function, specifically within the NXT macro in the xmlregexp module. An attacker can trigger the flaw by feeding specially crafted XML input to an application using the vulnerable library, causing the compo...
CVE-2026-86137
In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp...
CVE-2026-86137
In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp...
Out-of-bounds Read
Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the xmlFAParsePosCharGroup function. An attacker can cause the application to become unstable or crash by submitting specially crafted XML input that triggers reading beyond the allocated memory buffer. Remediation...
CVE-2026-86137
In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp...
CVE-2026-86137
In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp...
[slackware-security] libxml2
New libxml2 packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/libxml2-2.11.9-i586-10slack15.0.txz: Rebuilt. This update fixes bugs and security issues: xmlregexp: Prevent out-of-bounds read in NX...
PT-2026-86300
Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.15.4 Description An integer overflow exists in the xmlURIEscapeStr function within the uri.c file. An integer overflow occurs when an arithmetic operation results in a value that exceeds the maximum size of the...
CVE-2026-86143: Integer Coercion Error
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...
PT-2026-86298
Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.15.4 Description The xmlFAParsePosCharGroup function contains an out-of-bounds read, which also occurs within the NXT macro in xmlregexp. An out-of-bounds read is a condition where the software reads data past the e...
PT-2026-86299
Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.15.4 Description The xmlDictAddQString function in dict.c contains an integer overflow that can lead to a heap-based buffer overflow, a condition where data is written beyond the boundaries of a memory buffer...
PT-2026-86304
Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.15.4 Description An inconsistency between xmlOutputWriteCallback and xmlBufUse in the xmlIO component allows negative lengths to reach write callbacks due to a missing integer overflow check before the writecallback...