Security Bulletin: Vulnerability in libxml2 affects IBM Chassis Management Module (CVE-2016-9318)

Summary IBM Chassis Management Module has addressed the following vulnerability in libxml2. Vulnerability Details Summary IBM Chassis Management Module has addressed the following vulnerability in libxml2. Vulnerability Details: CVEID: CVE-2016-9318 Description: Libxml2 could allow a remote...

Security Bulletin: Vulnerability in libxml2 affects IBM RackSwitch Products (CVE-2017-8872)

Summary IBM RackSwitch Products have addressed the following vulnerability in libxml2. Vulnerability Details Summary IBM RackSwitch Products have addressed the following vulnerability in libxml2. Vulnerability Details: CVEID: CVE-2017-8872 Description: libxml2 is vulnerable to a buffer overflow,...

Security Bulletin: Vulnerabilities in libxml2 and zlib affect IBM RackSwitch Products

Summary IBM RackSwitch Products listed below have addressed the following vulnerabilities in libxml2 and zlib. Vulnerability Details Summary IBM RackSwitch Products listed below have addressed the following vulnerabilities in libxml2 and zlib. Vulnerability Details: CVEID: CVE-2016-4658...

Heap-based Buffer Over-read

libxml2.so is vulnerable to heap-based buffer over-read. The xmlParseInternalSubset function does not return when the end of the internal subset is detected and input is processed further. This results in a heap-based buffer over-read which can lead to a denial of service...

The vulnerability of the xmlStringGetNodeList function in the libxml2 library allows a attacker to cause a service failure.

The vulnerability of the function xmlStringGetNodeList in the tree.c library from the libxml2 library is caused by an uncontrolled recursion. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause a service failure using a specially crafted XML file...

The vulnerability of the xmlStringLenDecodeEntities function (parser.c) in the libxml2 library allows a attacker to cause a service failure or disclose protected information.

The vulnerability of the xmlStringLenDecodeEntities function in the parser.c file of the libxml2 library is due to insufficient restrictions on XML references to external objects. Exploiting this vulnerability could allow a malicious actor to cause service failures or disclose protected informati...

CVE-2018-14567

libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service infinite loop via a crafted XML file that triggers LZMAMEMLIMITERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251...

ALPINE-CVE-2018-14567

libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service infinite loop via a crafted XML file that triggers LZMAMEMLIMITERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251...

libxml2: XML External Entity vulnerability

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity XXE attacks via a crafte...

Heap-based Buffer Overflow

libxml2.so is vulnerable to heap-based buffer overflow. The xmlDictComputeFastQKey function in dict.c allows context-dependent attackers to obtain a negative offset in the name indexing that is used to randomize dictionary key generation. This can lead to a heap-based buffer overflow that results...

Denial Of Service (DoS)

libxml2.so is vulnerable to denial of service. A malicious user can pass an XML file to the xmlParseMarkupDecl function in parser.c to cause a buffer over-read that can crash the application or disclose sensitive information in the buffer...

Denial Of Service (DoS)

libxml2.so is vulnerable to denial of service DoS. The vulnerability exists due to the use-after-free errors occurring through the htmlParseChunk and xmldecldone functions...

Security Bulletin: Multiple vulnerabilities in libxml2 affect PowerKVM

Summary PowerKVM is affected by several vulnerabilities in libxml2. These vulnerabilities are now fixed. Vulnerability Details CVEID: CVE-2015-1819 DESCRIPTION: Libxml is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error in the xmlreader when processing XML...

Security Bulletin: PowerKVM is affected by a libxml2 vulnerability (CVE-2014-0191)

Summary PowerKVM is affected by libxml vulnerability CVE-2014-0191. Vulnerability Details CVEID: CVE-2014-0191 DESCRIPTION: Libxml2 is vulnerable to a denial of service, caused by the expansion of internal entities within the xmlParserHandlePEReference function. A remote attacker could exploit th...

Security Bulletin: Multiple vulnerabilities in libxml2 affect IBM Security Identity Governance

Summary Vulnerabilities in libxml2 that is used by IBM Security Identity Governance Vulnerability Details CVEID: CVE-2016-1762 DESCRIPTION: Apple Safari and Apple iOS could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruption error in libxml2. By persuadi...

Security Bulletin: IBM Security Guardium is affected by the OpenSource libxml2 vulnerability

Summary Libxml2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the xmlParseXMLDecl function. By using a malformed XML file, a local attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. Vulnerability...

Security Bulletin: A libxml vulnerability affects IBM Security Access Manager for Web (CVE-2015-1819)

Summary IBM Security Access Manager for Web is affected by a denial of service vulnerability in libxml2. Vulnerability Details CVEID: CVE-2015-1819 DESCRIPTION: Libxml is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error in the xmlreader when processing XML...

Security Bulletin: Vulnerability in libxml2 affects IBM InfoSphere Streams. (CVE-2015-8317)

Summary There is a vulnerability in libxml2 that is used by IBM InfoSphere Streams. IBM InfoSphere Streams has addressed this vulnerability. Vulnerability Details CVE-ID: CVE-2015-8317 Description: libxml2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the...

Denial Of Service (DoS)

libxml2.so is vulnerable to denial of service. The vulnerability exists in the xmlParserEntityCheck and xmlParseAttValueComplex functions that calls xmlStringDecodeEntities recursively without incrementing the depth counter, causing a stack buffer overflow attack which then lead to an application...

Cross-site Scripting (XSS)

sanitize is vulnerable to cross-site scripting XSS attacks. The vulnerability can occur under specific conditions when using libxml2 = 2.9.2. The vulnerability exists as an output is improperly sanitized, allowing non-whitelisted attributes to be formed through a given HTML fragment when parsed b...