7381 matches found
CVE-2022-51000
Removed by vendor...
CVE-2022-51000
Nokogiri (Ruby gem) versions before 1.13.2 (CRuby, when using packaged libraries) ship outdated vendored libxml2 2.9.12 and libxslt 1.1.34 . These are vulnerable to two upstream flaws: CVE-2021-30560 in libxslt (CVSS 8.8, DoS via untrusted XSL stylesheets) and CVE-2022-23308 in libxml2 (potential...
CVE-2023-54354
Removed by vendor...
CVE-2023-54354 Nokogiri before 1.14.3 Null Pointer Dereference via libxml2
Nokogiri before 1.14.3 CRuby implementation only, when using the packaged libxml2 bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK. An attacker who supplies a...
CVE-2022-50999 Nokogiri before 1.13.5 Integer Overflow via libxml2
Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes. Attackers can exploit this by crafting multi-gigabyte XML files to trigger buffer overflows resulting in information...
CVE-2022-50999
Removed by vendor...
EUVD-2022-56024
Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes. Attackers can exploit this by crafting multi-gigabyte XML files to trigger buffer overflows resulting in information...
CVE-2022-50999
...
CVE-2022-50999
CVE-2022-50999 has been rejected as a duplicate of CVE-2022-29824 . The underlying flaw is an integer overflow in the buffer handling functions (xmlBuf* in buf.c, xmlBuffer* in tree.c) of the packaged libxml2 shipped with Nokogiri (Ruby gem) versions before 1.13.5 . By submitting a crafted multi-...
EUVD-2021-34866
Nokogiri before 1.11.4 CRuby implementation only, when the packaged/vendored libxml2 is used bundles libxml2 2.9.10, which is affected by multiple vulnerabilities addressed in libxml2 2.9.12, including a memory leak in xmlSchemaValidateStream CVE-2019-20388, a global buffer over-read in...
EUVD-2022-56023
Nokogiri before 1.13.9 CRuby implementation using packaged libraries bundles libxml2 v2.9.14, which is affected by CVE-2022-40304 data corruption / double-free from an entity reference cycle when entity content is allocated from a dict and CVE-2022-40303 integer overflows when parsing with...
CVE-2022-50998
Removed by vendor...
CVE-2021-47996
Nokogiri before 1.11.4 (CRuby implementation using its packaged/vendored libxml2 2.9.10 ) is affected by multiple vulnerabilities in that bundled library, including a memory leak in xmlSchemaValidateStream, a global buffer over-read in xmlEncodeEntitiesInternal, a heap-based buffer overflow, and ...
CVE-2021-47996
...
CVE-2022-50998
CVE-2022-50998 affects Nokogiri before version 1.13.9 (CRuby implementation using packaged libraries), which bundles libxml2 v2.9.14 . The bundled library is vulnerable to data corruption/double-free from an entity reference cycle (CVE-2022-40304) and integer overflows when parsing with XML_PARSE...