7898 matches found
CVE-2024-58377
...
CVE-2024-58377 Nokogiri before 1.16.5 libxml2 Dependency Update
Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool. Nokogiri 1.16.5 upgrades the bundled libxml2 to 2.12.7 to address this. Per the maintainers, there is no impact to Nokogiri users because Nokogiri does not provide or expose the...
CVE-2024-58377
Nokogiri versions before 1.16.5 bundle libxml2 2.12.6 , which is affected by CVE-2024-34459 in the xmllint tool. The underlying issue is an uncontrolled search path element : an attacker can potentially influence the search path used for external libraries by manipulating environment variables or...
CVE-2023-54354
CVE-2023-54354 has been rejected as a duplicate , but its technical details remain relevant. Nokogiri before 1.14.3 (CRuby implementation only, using the packaged libxml2 v2.10.3 ) is vulnerable to NULL pointer dereferences in XML Schema processing (specifically in xmlSchemaFixupComplexType and x...
CVE-2022-51000 Nokogiri before 1.13.2 Multiple Vulnerabilities via libxml2 libxslt
Nokogiri before 1.13.2 CRuby, when using packaged libraries ships vendored libxml2 2.9.12 and libxslt 1.1.34, which are affected by two upstream CVEs. Via CVE-2021-30560 in libxslt, an application transforming XML with untrusted XSL stylesheets is vulnerable to a denial-of-service attack. Via...
CVE-2022-51000
...
EUVD-2023-60605
Nokogiri before 1.14.3 CRuby implementation only, when using the packaged libxml2 bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK. An attacker who supplies a...
CVE-2023-54354
...
EUVD-2022-56025
Nokogiri before 1.13.2 CRuby, when using packaged libraries ships vendored libxml2 2.9.12 and libxslt 1.1.34, which are affected by two upstream CVEs. Via CVE-2021-30560 in libxslt, an application transforming XML with untrusted XSL stylesheets is vulnerable to a denial-of-service attack. Via...
CVE-2022-51000
Removed by vendor...
CVE-2022-51000
Nokogiri (Ruby gem) versions before 1.13.2 (CRuby, when using packaged libraries) ship outdated vendored libxml2 2.9.12 and libxslt 1.1.34 . These are vulnerable to two upstream flaws: CVE-2021-30560 in libxslt (CVSS 8.8, DoS via untrusted XSL stylesheets) and CVE-2022-23308 in libxml2 (potential...
CVE-2023-54354
Removed by vendor...
CVE-2023-54354 Nokogiri before 1.14.3 Null Pointer Dereference via libxml2
Nokogiri before 1.14.3 CRuby implementation only, when using the packaged libxml2 bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK. An attacker who supplies a...
CVE-2022-50999 Nokogiri before 1.13.5 Integer Overflow via libxml2
Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes. Attackers can exploit this by crafting multi-gigabyte XML files to trigger buffer overflows resulting in information...