libxml2:xml: Heap-use-after-free in xmlTextReaderRead

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=5680824715051008 Project: libxml2 Fuzzing Engine: libFuzzer Fuzz Target: xml Job Type: libfuzzerasanlibxml2 Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x60c000000c4...

libxml2:xml: Use-of-uninitialized-value in xmlXIncludeIncludeNode

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=6544709487689728 Project: libxml2 Fuzzing Engine: libFuzzer Fuzz Target: xml Job Type: libfuzzermsanlibxml2 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

libxml2:xml: Heap-use-after-free in xmlNodeDumpOutputInternal

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=4837552128000000 Project: libxml2 Fuzzing Engine: libFuzzer Fuzz Target: xml Job Type: libfuzzerasanlibxml2 Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x60400000036...

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

...

xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.

...

PT-2020-21924

Name of the Vulnerable Software and Affected Versions libxml2 affected versions not specified Description The issue is related to a heap-use-after-free error. Technical details about the crash include the xmlXIncludeIncludeNode, xmlXIncludeDoProcess, and xmlXIncludeLoadFallback functions...

libxml2:xml: Heap-use-after-free in xmlXIncludeIncludeNode

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=6261568594247680 Project: libxml2 Fuzzing Engine: libFuzzer Fuzz Target: xml Job Type: libfuzzerasanlibxml2 Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x60c000000a0...

Amazon Linux AMI : libxml2 (ALAS-2020-1415)

The version of libxml2 installed on the remote host is prior to 2.9.1-6.4.40. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1415 advisory. A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval function of libxml2 through 2.9.8 wh...

Important: libxml2

Issue Overview: A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATHOPAND or XPATHOPOR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library...

PT-2020-6174

Name of the Vulnerable Software and Affected Versions Libxml2 version 2.9.10 Description The issue is related to a global buffer over-read vulnerability in the xmlEncodeEntitiesInternal function at libxml2/entities.c in the Libxml2 library. This vulnerability allows a remote attacker to access...

Security Bulletin: IBM MQ Appliance is affected by multiple libxml2 vulnerabilities

Summary IBM MQ Appliance has addressed multiple libxml2 vulnerabilities. Vulnerability Details CVEID: CVE-2015-8035 DESCRIPTION: libxml2 is vulnerable to a denial of service, caused by the failure to properly detect compression errors by the xzdecomp function. By using specially-crafted XML data,...

Amazon Linux 2 : libxml2 (ALAS-2020-1466)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1466 advisory. A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval function of libxml2 through 2.9.8 when...

Important: libxml2

Issue Overview: A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATHOPAND or XPATHOPOR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library...

PT-2020-21765

Name of the Vulnerable Software and Affected Versions libxml2 affected versions not specified Description The issue is related to a crash caused by an unknown read. Technical details about the crash include the involvement of specific functions such as xmlXPathCompileExpr, xmlXPathCompPrimaryExpr...

Security Bulletin: Libxml2 vulnerabilities affect IBM SmartCloud Entry (CVE-2015-1819)

Summary IBM SmartCloud Entry is vulnerable to several libxml2 vulnerabilities. Remote attackers can exploit them to consume all available memory resources. Vulnerability Details CVEID: CVE-2015-1819 DESCRIPTION: Libxml is vulnerable to a denial of service, caused by an XML External Entity Injecti...

Security Bulletin: Libxml2 vulnerabilities affect IBM SmartCloud Entry

Summary SmartCloud Entry is vulerable to libxml2 vulnerabilities. An attacker could exploit these vulnerabilities to obtain sensitive information, execute arbitrary codes, or cause a denial of service, segmentation faults or crahes CVE-2016-1762 CVE-2016-1833 CVE-2016-1834 CVE-2016-1835...

SUSE SLED15 / SLES15 Security Update : libxml2 (SUSE-SU-2020:1532-2)

This update for libxml2 fixes the following issues : CVE-2019-19956: Reverted the upstream fix for this memory leak because it introduced other, more severe vulnerabilities bsc1172021. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security...

SUSE-SU-2020:1532-2 Security update for libxml2

This update for libxml2 fixes the following issues: - CVE-2019-19956: Reverted the upstream fix for this memory leak because it introduced other, more severe vulnerabilities bsc1172021...

libxml2:html: Heap-use-after-free in xmlParserPrintFileContextInternal

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=6147358168711168 Project: libxml2 Fuzzing Engine: afl Fuzz Target: html Job Type: aflasanlibxml2 Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0x621000008d00 Crash...

MGASA-2020-0271 Updated libxml2 packages fix security vulnerability

Updated libxml2 packages fix security vulnerability: The fix for CVE-2019-19956 introduced regressions which can cause invalid xmlns references in output and memory leaks, possibly leading to more serious security issues. The broken fix has been reverted...