Security Bulletin: Vulnerabilities in XML processing affect IBM DataPower Gateways

Summary IBM DataPower Gateways has addressed vulnerabilities in processing certain XML files that could cause a denial of service or obtain sensitive information. Vulnerability Details CVEID: CVE-2016-4448 DESCRIPTION: libxml2 could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: Multiple vulnerabilities in libxml2 affect IBM MQ Appliance

Summary Heap-based buffer overflow flaws and denial of service flaws vulnerabilites in libxml2 affect the IBM MQ Appliance. IBM MQ Appliance has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-1762 DESCRIPTION: Apple Safari and Apple iOS could allow a remote attacker to execu...

Denial Of Service (DoS)

libxml2.so is vulnerable to denial of service. The vulnerability exists in the xmlParserEntityCheck and xmlParseAttValueComplex functions that calls xmlStringDecodeEntities recursively without incrementing the depth counter, causing a stack buffer overflow attack which then lead to an application...

Remote Code Execution (RCE)

libxml2.so is vulnerable to remote code execution RCE attacks. The application does not forbid namespace nodes in XPointer ranges, allowing a malicious user to inject and execute arbitrary code...

Security update for librsvg (moderate)

This update for librsvg fixes the following issues: - CVE-2018-1000041: Input validation issue could lead to credentials leak. bsc1083232 Update to version 2.40.20: + Except for emergencies, this will be the LAST RELEASE of the librsvg-2.40.x series. We are moving to 2.41, which is vastly improve...

openSUSE Security Update : librsvg (openSUSE-2018-466)

This update for librsvg fixes the following issues : - CVE-2018-1000041: Input validation issue could lead to credentials leak. bsc1083232 Update to version 2.40.20 : + Except for emergencies, this will be the LAST RELEASE of the librsvg-2.40.x series. We are moving to 2.41, which is vastly...

SUSE SLED12 / SLES12 Security Update : librsvg (SUSE-SU-2018:1288-1)

This update for librsvg fixes the following issues : - CVE-2018-1000041: Input validation issue could lead to credentials leak. bsc1083232 Update to version 2.40.20 : + Except for emergencies, this will be the LAST RELEASE of the librsvg-2.40.x series. We are moving to 2.41, which is vastly...

Denial Of Service (DoS)

libxml2.so is vulnerable to denial of service DoS attacks. A malicious user can pass a XML file to the htmlParseName function in HTMLparser.c to cause a buffer overread that can crash the application...

Denial Of Service (DoS)

libxml2.so is vulnerable to denial of service DoS attacks. A malicious user can pass a HTML file to the application with an unexpected character appended after the !DOCTYPE html substring, causing a heap-buffer overread that can crash the application...

EulerOS 2.0 SP2 : libxml2 (EulerOS-SA-2018-1089)

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial ...

EulerOS 2.0 SP1 : libxml2 (EulerOS-SA-2018-1088)

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial ...

Copy-Paste Vulnerability Through LibXML2

Nokogiri is vulnerable to attacks through a copied version of LibXML2 within the codebase. LibXML2 before 2.9.5 is vulnerable to CVE-2017-18258 - the LibXML2 decoder does not limit memory usage for what is required when decoding LZMA files...

GHSA-882P-JQGM-F45G Uncontrolled resource consumption in nokogiri

The xzhead function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service memory consumption via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file...

Denial of Service (DoS)

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Denial of Service DoS. The xzhead function in xzlib.c in libxml2 embedded in nokogiri before 2.9.6 allows remote attackers to cause a denial of service memory consumption via a...

Uncontrolled resource consumption in nokogiri

The xzhead function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service memory consumption via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file...

Moderate severity vulnerability that affects nokogiri

The xzhead function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service memory consumption via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file. References: -...

CVE-2017-18258

The xzhead function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service memory consumption via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file...

XML External Entity (XXE)

libxml2 is vulnerable to XML External Entity XXE attacks. The library does not disable document type declaration by default, allowing a malicious user to pass a file that can lead to arbitrary code execution or information disclosure...

CVE-2018-9251

The xzdecomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service infinite loop via a crafted XML file that triggers LZMAMEMLIMITERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035...

libxml2 Denial of Service Vulnerability (CNVD-2018-08420)

libxml2 is the GNOME project team developed a C-based library for parsing XML documents, which supports multiple encoding formats, Xpath parsing, Well-formed and valid validation. A security vulnerability exists in the 'xzhead' function of the xzlib.c file in versions of libxml2 prior to 2.9.6,...