SUSE CVE-2016-4449

XML external entity XXE vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or cause a denial of service resource consumption via unspecified vectors...

SUSE CVE-2017-15412

Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

SUSE CVE-2021-3518

There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability...

SUSE CVE-2021-3541

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service...

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset typically leading to a segmentation fault.

...

UBUNTU-CVE-2022-40303

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault...

CVE-2022-40304

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked...

CVE-2022-40303

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault...

The vulnerability of the object-cleaning function in the XML analysis library libxml2 allows a attacker to cause a service failure.

The vulnerability of the object-cleaning function in the XML library for analyzing XML documents, libxml2, is related to double memory deallocation when processing dict objects, where the first byte of the structure equals zero. Exploiting this vulnerability can allow an attacker to cause service...

PT-2022-36697 · Libxml2 · Libxml2

Name of the Vulnerable Software and Affected Versions: libxml2 affected versions not specified Description: The issue is related to a heap-use-after-free error. Technical details about the crash include the xmlXIncludeCopyXPointer, xmlXIncludeDoProcess, and xmlXIncludeProcessTreeFlagsData...

NULL Pointer Dereference

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to NULL Pointer Dereference due to the usage of a vulnerable version of the bundled libxml2 package. Remediation Upgrade nokogiri to version 1.13.9 or higher. References - GitHub...

AIX 7.2 TL 5 : libxml2 (IJ42339)

https://vulners.com/cve/CVE-2022-29824 https://vulners.com/cve/CVE-2022-29824 GNOME libxml2 is vulnerable to a denial of service, caused by an integer overflows in several buffer handling functions in buf.c xmlBuf and tree.c xmlBuffer. By persuading a victim to open a specially-crafted XML file, ...

OESA-2022-1828 libxml2 security update

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS : libxml2 vulnerability (USN-5548-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5548-1 advisory. It was discovered that libxml2 incorrectly handled certain XML files. An attacker could possibly use this issue to execute arbitrary code...

Oracle Linux 9 : libxml2 (ELSA-2022-5250)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-5250 advisory. 2.9.13-1.1 - Fix CVE-2022-29824 2082299 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus...

PT-2022-5386

Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.10.3 Description An issue was discovered in libxml2 where certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be...

PT-2022-5387

Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.10.3 Description The issue is related to an integer overflow in the xmlParseNameComplex function of the libxml2 library when parsing XML documents with the XML PARSE HUGE parser option enabled. This can lead to an...

F5 Networks BIG-IP : libxml2 vulnerability (K32760744)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.8 / 16.1.4 / 17.1.0. It is, therefore, affected by a vulnerability as referenced in the K32760744 advisory. valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.CVE-2022-23308 Tenable has...

Denial Of Service (DoS)

libxml2.so is vulnerable to denial of service. The xmlBufCreateSize function of buf.c does not properly check types of buffer sizes, allowing an attacker to crash the application by providing large multi-gigabyte buffers...

DEBIAN-CVE-2022-29824

In libxml2 before 2.9.14, several buffer handling functions in buf.c xmlBuf and tree.c xmlBuffer don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer...