openSUSE Security Update : libxml2 (openSUSE-2017-663)

This update for libxml2 fixes the following issues : - CVE-2017-9047, CVE-2017-9048: The function xmlSnprintfElementContent in valid.c was vulnerable to a stack-based buffer overflow bsc1039063, bsc1039064 - CVE-2017-9049: The function xmlDictComputeFastKey in dict.c was vulnerable to a heap-base...

libxml2: Heap-buffer-overflow in xmlFAParsePosCharGroup

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed report: https://oss-fuzz.com/testcase?key=6008601485246464 Project: libxml2 Fuzzer: afllibxml2xmlregexpcompilefuzzer Fuzz target binary: libxml2xmlregexpcompilefuzzer Job Type: aflasanlibxml2 Platform Id: linux Crash Type:...

libxml2: Use-of-uninitialized-value in __xmlRaiseError

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed report: https://oss-fuzz.com/testcase?key=6656585537421312 Project: libxml2 Fuzzer: libFuzzerlibxml2xmlreadmemoryfuzzer Fuzz target binary: libxml2xmlreadmemoryfuzzer Job Type: libfuzzermsanlibxml2 Platform Id: linux Crash Type:...

libxml2: Use-of-uninitialized-value in xmlValidateRef

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed report: https://oss-fuzz.com/testcase?key=5884925003694080 Project: libxml2 Fuzzer: libFuzzerlibxml2xmlreadmemoryfuzzer Fuzz target binary: libxml2xmlreadmemoryfuzzer Job Type: libfuzzermsanlibxml2 Platform Id: linux Crash Type:...

libxml2: Stack-buffer-overflow in xmlSnprintfElementContent

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed report: https://oss-fuzz.com/testcase?key=4931910683852800 Project: libxml2 Fuzzer: libFuzzerlibxml2xmlreadmemoryfuzzer Fuzz target binary: libxml2xmlreadmemoryfuzzer Job Type: libfuzzerasanlibxml2 Platform Id: linux Crash Type:...

SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2017:1454-1)

This update for libxml2 fixes the following issues : - CVE-2017-9047, CVE-2017-9048: The function xmlSnprintfElementContent in valid.c was vulnerable to a stack-based buffer overflow bsc1039063, bsc1039064 - CVE-2017-9049: The function xmlDictComputeFastKey in dict.c was vulnerable to a heap-base...

SUSE-SU-2017:1454-1 Security update for libxml2

This update for libxml2 fixes the following issues: - CVE-2017-9047, CVE-2017-9048: The function xmlSnprintfElementContent in valid.c was vulnerable to a stack buffer overflow bsc1039063, bsc1039064 - CVE-2017-9049: The function xmlDictComputeFastKey in dict.c was vulnerable to a heap-based buffe...

libxml2 incomplete fix for stack buffer overflow vulnerability

Libxml2 is the GNOME project team developed a C-based library for parsing XML documents. Libxml2 suffers from a stack-based buffer overflow vulnerability that arises from a program that does not perform proper boundary checking on user input. An attacker could use this vulnerability to execute...

SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2017:1366-1)

This update for libxml2 fixes the following issues : - Fix NULL dereference in xpointer.c when in recovery mode bsc1014873 - CVE-2016-9597: An XML document with many opening tags could have caused a overflow of the stack not detected by the recursion limits, allowing for DoS bsc1017497 -...

SUSE-SU-2017:1366-1 Security update for libxml2

This update for libxml2 fixes the following issues: Fix NULL dereference in xpointer.c when in recovery mode bsc1014873 CVE-2016-9597: An XML document with many opening tags could have caused a overflow of the stack not detected by the recursion limits, allowing for DoS bsc1017497 CVE-2014-0191:...

libxml2 Heap Buffer Overflow Out-of-Bounds Read Vulnerability

libxml2 is the GNOME project team developed a C-based library for parsing XML documents, which supports multiple encoding formats, Xpath parsing, Well-formed and valid validation. A heap buffer overflow out-of-bounds read vulnerability exists in the 'xmlDictComputeFastKey' function of the dict.c...

libxml2 Buffer Overflow Vulnerability

libxml2 is the GNOME project team developed a C-based library for parsing XML documents, which supports multiple encoding formats, Xpath parsing, Well-formed and valid validation. A buffer overflow vulnerability exists in version libxml2 20904-GITv2.9.4-16-g0741801. An attacker can exploit this...

libxml2 Stack Buffer Overflow Vulnerability

libxml2 is the GNOME project team developed a C-based library for parsing XML documents, which supports multiple encoding formats, Xpath parsing, Well-formed and valid validation. A stack buffer overflow vulnerability exists in version libxml2 20904-GITv2.9.4-16-g0741801. An attacker can exploit...

libxml2 heap buffer overflow out-of-bounds read vulnerability (CNVD-2017-07325 )

libxml2 is the GNOME project team developed a C-based library for parsing XML documents, which supports multiple encoding formats, Xpath parsing, Well-formed and valid validation. A heap buffer overflow out-of-bounds read vulnerability exists in the 'xmlDictAddString' function of the dict.c file ...

CVE-2017-9050

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839...

CVE-2017-9047

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlenbuf. If the content-type is...

CVE-2017-9049

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398...

Denial Of Service (DoS) Through Embedded C Library

The nokogiri gem is using libxml2 which is vulnerable to CVE-2016-3627. CVE-2016-3627 is a denial of service DoS vulnerability. It is possible because the xmlStringGetNodeList and xmlParserEntityCheck functions fail to detect a recursive loop when it is used in recovery mode, causing stack...

Use-after-free Vulnerability

nokogiri gem is using libxml2 which is vulnerable to use-after-free vulnerability. The vulnerability exists because libxml2 fails to properly validate and handle the attribute strings in the xmlSAX2AttributeNs function which allows an attacker to cause a memory corruption which leads to an...

Heap overflow

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839...