Nokogiri gem contains several vulnerabilities in libxml2 and libxslt

Nokogiri version 1.7.1 has been released, pulling in several upstream patches to the vendored libxml2 to address the following CVEs: CVE-2016-4658 CVSS v3 Base Score: 9.8 Critical libxml2 in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to...

Security fix for the ALT Linux 8 package libxml2 version 1:2.9.4.0.12.e905-alt1

1:2.9.4.0.12.e905-alt1 built March 7, 2017 Dmitry V. Levin in task 179256 --- March 3, 2017 Dmitry V. Levin - v2.9.3-5-g65112cb - v2.9.4-12-ge905f08 fixes: CVE-2016-1833, CVE-2016-1834, CVE-2016-1835, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, CVE-2016-1840, CVE-2016-3627,...

PT-2017-3325

Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.9.5 Description The issue is caused by a buffer overflow in the NEXTL macro of the libxml2 library's xml parser, specifically in the parser.c file. This can be exploited by a remote attacker to inject XML external...

PT-2018-5109

Name of the Vulnerable Software and Affected Versions libxml2 affected versions not specified Description The issue allows context-dependent attackers to cause a denial of service, resulting in an out-of-bounds read and application crash, via a crafted XML document. Recommendations At the moment,...

Security fix for the ALT Linux 10 package libxml2 version 1:2.9.4.0.12.e905-alt1

March 3, 2017 Dmitry V. Levin 1:2.9.4.0.12.e905-alt1 - v2.9.3-5-g65112cb - v2.9.4-12-ge905f08 fixes: CVE-2016-1833, CVE-2016-1834, CVE-2016-1835, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, CVE-2016-1840, CVE-2016-3627, CVE-2016-3705, CVE-2016-4449, CVE-2016-4483, CVE-2016-4658,...

PT-2017-3747

Name of the Vulnerable Software and Affected Versions: libxml2 affected versions not specified Description: A flaw in libxml2 allows remote XML entity inclusion with default parser flags. This may expose a higher-risk attack surface, allowing access to content from local files, HTTP, or FTP...

PT-2018-5107 · Xmlsoft +1 · Libxml2 +1

Name of the Vulnerable Software and Affected Versions: libxml2 affected versions not specified Description: The issue allows context-dependent attackers to cause a denial of service stack consumption via a crafted XML document. This problem exists due to an incorrect fix for a previous issue...

Security fix for the ALT Linux 9 package libxml2 version 1:2.9.4.0.12.e905-alt1

March 3, 2017 Dmitry V. Levin 1:2.9.4.0.12.e905-alt1 - v2.9.3-5-g65112cb - v2.9.4-12-ge905f08 fixes: CVE-2016-1833, CVE-2016-1834, CVE-2016-1835, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, CVE-2016-1840, CVE-2016-3627, CVE-2016-3705, CVE-2016-4449, CVE-2016-4483, CVE-2016-4658,...

F5 Networks BIG-IP : libxml2 vulnerability (K04450715)

dict.c in libxml2 allows remote attackers to cause a denial of service heap-based buffer over-read and application crash via an unexpected character immediately after the '!DOCTYPE html' substring in a crafted HTML document. CVE-2015-8806 C Tenable Network Security, Inc. The descriptive text and...

XML External Entity (XXE) Via Libxml2

nokogiri is using libxml2 library which is vulnerable to the CVE-2016-9318. The vulnerability is only possible when applications using nokogiri 1.5.4 and later do not opt into the DTDLOAD option and opt out of the NONET option. The default setting in nokogiri does not use both DTD loading and...

libxml2 Null Pointer Reference Denial of Service Vulnerability

Libxml2 is the GNOME project team developed a C-based library for parsing XML documents. A denial of service vulnerability exists in libxml2. An attacker can exploit this vulnerability to cause a denial of service...

libxml2: Heap-buffer-overflow in xmlAddID

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed report: https://oss-fuzz.com/testcase?key=4626005117370368 Project: libxml2 Fuzzer: libxml2xmlreadmemoryfuzzer Job Type: libfuzzerasanlibxml2 Crash Type: Heap-buffer-overflow WRITE 4 Crash Address: 0x60b000001410 Crash State: xmlAddID...

CVE-2017-5969

A NULL pointer dereference was discovered in libxml2, when using xmllint --recover. A maliciously crafted file, when parsed in recovery mode, could cause the application to crash...

openSUSE Security Update : libxml2 (openSUSE-2017-244)

This update for libxml2 fixes the following issues : - CVE-2016-4658: use-after-free error could lead to crash bsc1005544 - Fix NULL dereference in xpointer.c when in recovery mode bsc1014873 - CVE-2016-9597: An XML document with many opening tags could have caused a overflow of the stack not...

PT-2017-4233 · Xmlsoft +2 · Libxml2 +2

Name of the Vulnerable Software and Affected Versions: libxml2 version 2.9.4 Description: The issue is related to a denial of service caused by a NULL pointer dereference when libxml2 is used in recover mode. This can be triggered by a remote attacker via a crafted XML document. The maintainer of...

SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2017:0380-1)

This update for libxml2 fixes the following issues : - CVE-2016-4658: use-after-free error could lead to crash bsc1005544 - Fix NULL dereference in xpointer.c when in recovery mode bsc1014873 - CVE-2016-9597: An XML document with many opening tags could have caused a overflow of the stack not...

SUSE-SU-2017:0380-1 Security update for libxml2

This update for libxml2 fixes the following issues: CVE-2016-4658: use-after-free error could lead to crash bsc1005544 Fix NULL dereference in xpointer.c when in recovery mode bsc1014873 CVE-2016-9597: An XML document with many opening tags could have caused a overflow of the stack not detected b...

GLSA-201701-37 : libxml2: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201701-37 libxml2: Multiple vulnerabilities Multiple vulnerabilities have been discovered in libxml2. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user or automated syst...

SUSE SLES11 Security Update : libxml2 (SUSE-SU-2017:0164-1)

This update for libxml2 fixes the following issues : - CVE-2016-9318: libxml2 did not offer a flag directly indicating that the current document may be read but other files may not be opened, which made it easier for remote attackers to conduct XML External Entity XXE attacks via a crafted docume...

SUSE-SU-2017:0164-1 Security update for libxml2

This update for libxml2 fixes the following issues: CVE-2016-9318: libxml2 did not offer a flag directly indicating that the current document may be read but other files may not be opened, which made it easier for remote attackers to conduct XML External Entity XXE attacks via a crafted document...