CVE-2024-58378 Nokogiri before 1.16.2 Use-After-Free via xmlTextReader

Nokogiri before 1.15.6 and 1.16.x before 1.16.2 CRuby, when using the packaged libxml2 is affected by a use-after-free vulnerability in libxml2 CVE-2024-25062 in the xmlTextReader module, which underlies Nokogiri::XML::Reader. When using the XML Reader interface with DTD validation and XInclude...

EUVD-2024-55731

Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool. Nokogiri 1.16.5 upgrades the bundled libxml2 to 2.12.7 to address this. Per the maintainers, there is no impact to Nokogiri users because Nokogiri does not provide or expose the...

CVE-2024-58377

Removed by vendor...

CVE-2024-58377 Nokogiri before 1.16.5 libxml2 Dependency Update

Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool. Nokogiri 1.16.5 upgrades the bundled libxml2 to 2.12.7 to address this. Per the maintainers, there is no impact to Nokogiri users because Nokogiri does not provide or expose the...

CVE-2024-58377

...

CVE-2024-58377

...

CVE-2024-58377

Nokogiri versions before 1.16.5 bundle libxml2 2.12.6 , which is affected by CVE-2024-34459 in the xmllint tool. The underlying issue is an uncontrolled search path element : an attacker can potentially influence the search path used for external libraries by manipulating environment variables or...

CVE-2023-54354 Nokogiri before 1.14.3 Null Pointer Dereference via libxml2

Nokogiri before 1.14.3 CRuby implementation only, when using the packaged libxml2 bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK. An attacker who supplies a...

CVE-2023-54354

Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles libxml2 v2.10.3 , which contains NULL pointer dereference vulnerabilities in XML Schema processing functions (xmlSchemaFixupComplexType and xmlSchemaCheckCOSSTDerivedOK ). An attacker supplying a crafted o...

CVE-2022-51000 Nokogiri before 1.13.2 Multiple Vulnerabilities via libxml2 libxslt

Nokogiri before 1.13.2 CRuby, when using packaged libraries ships vendored libxml2 2.9.12 and libxslt 1.1.34, which are affected by two upstream CVEs. Via CVE-2021-30560 in libxslt, an application transforming XML with untrusted XSL stylesheets is vulnerable to a denial-of-service attack. Via...

CVE-2022-51000 Nokogiri before 1.13.2 Multiple Vulnerabilities via libxml2 libxslt

Nokogiri before 1.13.2 CRuby, when using packaged libraries ships vendored libxml2 2.9.12 and libxslt 1.1.34, which are affected by two upstream CVEs. Via CVE-2021-30560 in libxslt, an application transforming XML with untrusted XSL stylesheets is vulnerable to a denial-of-service attack. Via...

CVE-2022-51000 Nokogiri before 1.13.2 Multiple Vulnerabilities via libxml2 libxslt

Nokogiri before 1.13.2 CRuby, when using packaged libraries ships vendored libxml2 2.9.12 and libxslt 1.1.34, which are affected by two upstream CVEs. Via CVE-2021-30560 in libxslt, an application transforming XML with untrusted XSL stylesheets is vulnerable to a denial-of-service attack. Via...

EUVD-2022-56025

Nokogiri before 1.13.2 CRuby, when using packaged libraries ships vendored libxml2 2.9.12 and libxslt 1.1.34, which are affected by two upstream CVEs. Via CVE-2021-30560 in libxslt, an application transforming XML with untrusted XSL stylesheets is vulnerable to a denial-of-service attack. Via...

CVE-2023-54354 Nokogiri before 1.14.3 Null Pointer Dereference via libxml2

Nokogiri before 1.14.3 CRuby implementation only, when using the packaged libxml2 bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK. An attacker who supplies a...

EUVD-2023-60605

Nokogiri before 1.14.3 CRuby implementation only, when using the packaged libxml2 bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK. An attacker who supplies a...

CVE-2022-51000

Nokogiri before 1.13.2 (CRuby, when using packaged libraries) ships vendored libxml2 2.9.12 and libxslt 1.1.34 , inheriting two upstream vulnerabilities. Via CVE-2021-30560 in libxslt, transforming XML with untrusted XSL stylesheets can trigger a denial of service . Via CVE-2022-23308 in libxml2,...

CVE-2023-54354 Nokogiri before 1.14.3 Null Pointer Dereference via libxml2

Nokogiri before 1.14.3 CRuby implementation only, when using the packaged libxml2 bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK. An attacker who supplies a...

CVE-2022-50999 Nokogiri before 1.13.5 Integer Overflow via libxml2

Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes. Attackers can exploit this by crafting multi-gigabyte XML files to trigger buffer overflows resulting in information...

CVE-2022-50999 Nokogiri before 1.13.5 Integer Overflow via libxml2

Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes. Attackers can exploit this by crafting multi-gigabyte XML files to trigger buffer overflows resulting in information...

EUVD-2022-56024

Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes. Attackers can exploit this by crafting multi-gigabyte XML files to trigger buffer overflows resulting in information...