CVE-2016-9318

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity XXE attacks via a crafte...

CVE-2016-9318

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity XXE attacks via a crafte...

UBUNTU-CVE-2016-9318

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity XXE attacks via a crafte...

openSUSE Security Update : libxml2 (openSUSE-2016-1265)

This update for libxml2 fixes the following issues : - CVE-2016-4658: libxml2 allowed remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted XML document boo1005544. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

openSUSE Security Update : libxml2 (openSUSE-2016-1259)

This update for libxml2 fixes the following issues : - CVE-2016-4658: Use after free via namespace node in XPointer ranges bsc1005544. This update was imported from the SUSE:SLE-12:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks ...

[ASA-201611-2] libxml2: arbitrary code execution

Arch Linux Security Advisory ASA-201611-2 ========================================= Severity: Critical Date : 2016-11-01 CVE-ID : CVE-2016-4658 CVE-2016-5131 Package : libxml2 Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package...

Debian DLA-691-1 : libxml2 security update

CVE-2016-4658 Namespace nodes must be copied to avoid use-after-free errors. But they don't necessarily have a physical representation in a document, so simply disallow them in XPointer ranges. CVE-2016-5131 The old code would invoke the broken xmlXPtrRangeToFunction. range-to isn't really a...

[SECURITY] [DLA 691-1] libxml2 security update

Package : libxml2 Version : 2.8.0+dfsg1-7+wheezy7 CVE ID : CVE-2016-4658 CVE-2016-5131 CVE-2016-4658 Namespace nodes must be copied to avoid use-after-free errors. But they dont necessarily have a physical representation in a document, so simply disallow them in XPointer ranges. CVE-2016-5131 The...

DLA-691-1 libxml2 - security update

Bulletin has no description...

SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2016:2650-1)

This update for libxml2 fixes the following issues : - CVE-2016-4658: Use after free via namespace node in XPointer ranges bsc1005544. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically...

SUSE SLES11 Security Update : libxml2 (SUSE-SU-2016:2652-1)

This update for libxml2 fixes the following issues : - CVE-2016-4658: Use after free via namespace node in XPointer ranges bsc1005544. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically...

SUSE-SU-2016:2652-1 Security update for libxml2

This update for libxml2 fixes the following issues: - CVE-2016-4658: Use after free via namespace node in XPointer ranges bsc1005544...

SUSE-SU-2016:2650-1 Security update for libxml2

This update for libxml2 fixes the following issues: - CVE-2016-4658: Use after free via namespace node in XPointer ranges bsc1005544...

Amazon Linux: Security Advisory (ALAS-2016-719)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

libxml2: Heap-buffer-overflow in xmlDictComputeFastKey

Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5675748065017856 Fuzzer: libFuzzerlibxml2xmlreadmemoryfuzzer Job Type: libfuzzerasanlibxml2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

PT-2016-3441

Name of the Vulnerable Software and Affected Versions libxml2 versions 2.9.4 and earlier Description The issue is related to the incorrect restriction of XML links to external objects, making it easier for remote attackers to conduct XML External Entity XXE attacks via a crafted document. This...

Apple iOS < 10.0 Multiple Vulnerabilities

Binary data 9619.prm...

SUSE-RU-2016:2413-1 Recommended update for libxml2

This update for libxml2 fixes an issue when processing external entities introduced with the fix for CVE-2014-0191...

Apple TV < 10 Multiple Vulnerabilities

According to its banner, the version of Apple TV on the remote device is prior to 10. It is, therefore, affected by multiple vulnerabilities in the following components : - Audio - CFNetwork - CoreCrypto - FontParser - IOAcceleratorFamily - Kernel - libxml2 - libxslt - Security - WebKit Note that...

Libxml2 memory corruption vulnerability in multiple Apple products (CNVD-2016-08340)

Apple iOS, OS X, tvOS, and watchOS are all products of Apple Inc. Apple iOS is an operating system developed for mobile devices; Apple OS X is a specialized operating system developed for Mac computers; tvOS is a smart TV operating system; and watchOS is a smart watch operating system. Libxml2 is...