Rocky Linux 8 [CIQ] Security Update: libxml2 / libxml2-debuginfo / libxml2-debugsource / libxml2-devel / etc Multiple Vulnerabilities (crlsa-2023_0173)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20230173 advisory. libxml2: integer overflows with XMLPARSEHUGE CVE-2022-40303 libxml2: dict corruption caused by entity reference cycles CVE-2022-40304 Tenable has extracted...

Rocky Linux 9 [CIQ] Security Update: libxml2 / libxml2-debuginfo / libxml2-debugsource / libxml2-devel / etc Multiple Vulnerabilities (crlsa-2023_0338)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20230338 advisory. libxml2: integer overflows with XMLPARSEHUGE CVE-2022-40303 libxml2: dict corruption caused by entity reference cycles CVE-2022-40304 Tenable has extracted...

MiracleLinux 9 : libxml2-2.9.13-3.el9 (AXSA:2023-4863:02)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-4863:02 advisory. libxml2: integer overflows with XMLPARSEHUGE CVE-2022-40303 libxml2: dict corruption caused by entity reference cycles CVE-2022-40304 Tenable has...

CVE-2023-52654

A security vulnerability was identified in the Linux kernel's iouring subsystem, specifically related to the handling of file descriptors over UNIX domain sockets. The issue arises from the potential for file reference cycles when iouring file descriptors are transmitted over sockets using the...

DEBIAN-CVE-2023-52654

In the Linux kernel, the following vulnerability has been resolved: iouring/afunix: disable sending iouring over sockets File reference cycles have caused lots of problems for iouring in the past, and it still doesn't work exactly right and races with unixstreamreadgeneric. The safest fix would b...

UBUNTU-CVE-2023-52654

In the Linux kernel, the following vulnerability has been resolved: iouring/afunix: disable sending iouring over sockets File reference cycles have caused lots of problems for iouring in the past, and it still doesn't work exactly right and races with unixstreamreadgeneric. The safest fix would b...

SUSE CVE-2023-52654

In the Linux kernel, the following vulnerability has been resolved: iouring/afunix: disable sending iouring over sockets File reference cycles have caused lots of problems for iouring in the past, and it still doesn't work exactly right and races with unixstreamreadgeneric. The safest fix would b...

CVE-2023-52654

The CVE-2023-52654 entry concerns the Linux kernel io_uring/af_unix component. The issue arises from file reference cycles when io_uring files are sent via sockets, which can race with unix_stream_read_generic(). The safe fix implemented is to disallow sending io_uring files over sockets via SCM_...

CVE-2023-52654 io_uring/af_unix: disable sending io_uring over sockets

In the Linux kernel, the following vulnerability has been resolved: iouring/afunix: disable sending iouring over sockets File reference cycles have caused lots of problems for iouring in the past, and it still doesn't work exactly right and races with unixstreamreadgeneric. The safest fix would b...

CVE-2023-52654: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iouring/afunix: disable sending iouring over sockets File reference cycles have caused lots of problems for iouring in the past, and it still doesn't work exactly right and races with unixstreamreadgeneric. The safest fix would b...

PT-2024-8166

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to errors in resource management in the io uring/af unix component of the Linux kernel. This can lead to problems such as file reference cycles, which have caused...

libxml2: dict corruption caused by entity reference cycles

A flaw was found in libxml2. When a reference cycle is detected in the XML entity cleanup function the XML entity data can be stored in a dictionary. In this case, the dictionary becomes corrupted resulting in logic errors, including memory errors like double free...

libxml2: dict corruption caused by entity reference cycles

A flaw was found in libxml2. When a reference cycle is detected in the XML entity cleanup function the XML entity data can be stored in a dictionary. In this case, the dictionary becomes corrupted resulting in logic errors, including memory errors like double free...

CLSA-2022-1670523520 libxml2: Fix of 2 CVEs

CVE-2022-40303: fix integer overflows with XMLPARSEHUGE - CVE-2022-40304: fix dict corruption caused by entity reference cycles...

CLSA-2022-1670523403 libxml2: Fix of 2 CVEs

CVE-2022-40303: fix integer overflows with XMLPARSEHUGE - CVE-2022-40304: fix dict corruption caused by entity reference cycles...

CLSA-2022-1670522857 libxml2: Fix of 2 CVEs

CVE-2022-40303: fix integer overflows with XMLPARSEHUGE - CVE-2022-40304: fix dict corruption caused by entity reference cycles...

libxml2: Fix of 2 CVEs

CVE-2022-40303: fix integer overflows with XMLPARSEHUGE - CVE-2022-40304: fix dict corruption caused by entity reference cycles...

CLSA-2022-1670521677 libxml2: Fix of 2 CVEs

CVE-2022-40303: fix integer overflows with XMLPARSEHUGE - CVE-2022-40304: fix dict corruption caused by entity reference cycles...

CLSA-2022-1670518262 Fix CVE(s): CVE-2022-40303, CVE-2022-40304

SECURITY UPDATE: Integer overflows with XMLPARSEHUGE - debian/patches/CVE-2022-40303.patch: Impose size limits when XMLPARSEHUGE is set and add length checks to core parser functions - CVE-2022-40303 SECURITY UPDATE: Dict corruption caused by entity reference cycles -...

libxml2: dict corruption caused by entity reference cycles

A flaw was found in libxml2. When a reference cycle is detected in the XML entity cleanup function the XML entity data can be stored in a dictionary. In this case, the dictionary becomes corrupted resulting in logic errors, including memory errors like double free...