CVE-2021-3516

There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability...

Debian DLA-2669-1 : libxml2 security update

An issue has been found in libxml2, the GNOME XML library. This issue is called 'Parameter Laughs'-attack and is related to parameter entities expansion. It is similar to the 'Billion Laughs'-attacks found earlier in libexpat. More information can be found at 1 1...

Debian: Security Advisory (DLA-2669-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Important Photon OS Security Update - PHSA-2021-0399

Updates of 'libxml2' packages of Photon OS have been released...

DLA-2669-1 libxml2 - security update

Bulletin has no description...

[SECURITY] Fedora 34 Update: python-lxml-4.6.3-1.fc34

lxml is a Pythonic, mature binding for the libxml2 and libxslt libraries. It provides safe and convenient access to these libraries using the ElementTre e It extends the ElementTree API significantly to offer support for XPath, Relax NG, XML Schema, XSLT, C14N and much more.To contact the project...

Fedora: Security Advisory for libxml2 (FEDORA-2021-e8b7e177a4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality integrity and availability.

...

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

...

Oracle Linux 8 : libxml2 (ELSA-2021-1597)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-1597 advisory. 2.9.7-9.0.1 - Update doc/redhat.gif in tarball - Add libxml2-oracle-enterprise.patch and update logos in tarball 2.9.7-9 - Fix CVE-2020-24977 1878252 Tenable ha...

libxml2 security update

2.9.7-9.0.1 - Update doc/redhat.gif in tarball - Add libxml2-oracle-enterprise.patch and update logos in tarball 2.9.7-9 - Fix CVE-2020-24977 1878252...

openSUSE Security Update : libxml2 (openSUSE-2021-764)

This update for libxml2 fixes the following issues : - CVE-2021-3537: NULL pointer dereference in valid.c:xmlValidBuildAContentModel bsc1185698 - CVE-2021-3518: Fixed a use after free in xinclude.c:xmlXIncludeDoProcess bsc1185408. - CVE-2021-3517: Fixed a heap based buffer overflow in...

[SECURITY] Fedora 34 Update: libxml2-2.9.12-2.fc34

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

FreeBSD : libxml2 -- Possible denial of service (524bd03a-bb75-11eb-bf35-080027f515ea)

Daniel Veillard reports : A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

openSUSE: Security Advisory for libxml2 (openSUSE-SU-2021:0764-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Billion Laugh Attack

libxml2:sid is vulnerable to billion laugh attack via parameter entities expansion and following the line of the billion laugh attack...

OPENSUSE-SU-2021:0764-1 Security update for libxml2

This update for libxml2 fixes the following issues: - CVE-2021-3537: NULL pointer dereference in valid.c:xmlValidBuildAContentModel bsc1185698 - CVE-2021-3518: Fixed a use after free in xinclude.c:xmlXIncludeDoProcess bsc1185408. - CVE-2021-3517: Fixed a heap based buffer overflow in...

Security update for libxml2 (important)

openSUSE Security Update: Security update for libxml2 Announcement ID: openSUSE-SU-2021:0764-1 Rating: important References: 1185408 1185409 1185410 1185698 Cross-References: CVE-2021-3516 CVE-2021-3517 CVE-2021-3518 CVE-2021-3537 CVSS scores: CVE-2021-3516 SUSE: 5.9...

libxml2 Resource Management Error Vulnerability

libxml2 is an open source library used to parse XML documents . It is written in C, and can be called for a variety of languages , such as C, C++, XSH. A resource management error vulnerability exists in libxml2 versions prior to 2.9.11. This vulnerability can be exploited to trigger post-release...

A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.

...