211 matches found
VectorFreed
VectorFreed Abstract This document introduces "VectorFreed", a vulnerability chain that begins with a use-after-free I @rafabd1 found in librsvg CVE-2026-96889. In a Node.js/Sharp/libvips build, this bug led to command execution. It covers the bug, the paths confirmed in applications so far, and...
GHSA-CPVR-W4J5-2MPG Librsvg: Use-after-free when XML includes have duplicated entities
Librsvg uses libxml2, a C library, to parse XML. When librsvg parses an SVG document which has a nested Xinclude, an XML entity declaration with a duplicate name as an existing one can cause a use-after-free error. While libxml2 is expanding an internal entity, a recursive XInclude can parse...
Librsvg: Use-after-free when XML includes have duplicated entities
Librsvg uses libxml2, a C library, to parse XML. When librsvg parses an SVG document which has a nested Xinclude, an XML entity declaration with a duplicate name as an existing one can cause a use-after-free error. While libxml2 is expanding an internal entity, a recursive XInclude can parse...
Astra Linux – Vulnerability in libxml2
A issue was discovered in libxml2 before versions 2.11.7 and 2.12.x, and even before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to a use-after-free of the xmlValidatePopElement function...
GHSA-XM28-XVQC-GXXG Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution
Copernik XML Factory through 0.1.1, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory or XmlFactories.newSAXParserFactory, or on an XMLReader passed through...
Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution
Copernik XML Factory through 0.1.1, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory or XmlFactories.newSAXParserFactory, or on an XMLReader passed through...
PT-2026-105986
Copernik XML Factory through 0.1.1, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory or XmlFactories.newSAXParserFactory, or on an XMLReader passed through...
PT-2026-105552
Copernik XML Factory through 0.1.1, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory or XmlFactories.newSAXParserFactory, or on an XMLReader passed through...
Rocky Linux 9.6 [TuxCare] Security Update: inkscape / inkscape-docs / inkscape-view (ALMALINUX9.6:CLSA-2026:1787131590)
The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787131590 advisory. - A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote attacker to read...
AlmaLinux 9.6 [TuxCare] Security Update: inkscape / inkscape-docs / inkscape-view (ALMALINUX9.6:CLSA-2026:1787131590)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787131590 advisory. - A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote attacker to read loca...
AlmaLinux 9.2 [TuxCare] Security Update: inkscape / inkscape-docs / inkscape-view (ALMALINUX9.2:CLSA-2026:1788452050)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788452050 advisory. - A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote attacker to read loca...
AlmaLinux 9.2 [TuxCare] Security Update: libxml2 / libxml2-devel / libxml2-static / python3-libxml2 (ALMALINUX9.2:CLSA-2024:1708416911)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1708416911 advisory. - An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and...
libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.
A flaw in libxml2's XInclude processing xmlXIncludeProcess and xmlXIncludeProcessTree fails to propagate parser flags like XMLPARSENONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery SSRF, XML External Entity XXE...
libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.
A flaw in libxml2's XInclude processing xmlXIncludeProcess and xmlXIncludeProcessTree fails to propagate parser flags like XMLPARSENONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery SSRF, XML External Entity XXE...
libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.
A flaw in libxml2's XInclude processing xmlXIncludeProcess and xmlXIncludeProcessTree fails to propagate parser flags like XMLPARSENONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery SSRF, XML External Entity XXE...
Use-after-free when XML includes have duplicated entities
Librsvg uses libxml2, a C library, to parse XML. When librsvg parses an SVG document which has a nested Xinclude, an XML entity declaration with a duplicate name as an existing one can cause a use-after-free error. While libxml2 is expanding an internal entity, a recursive XInclude can parse...
RUSTSEC-2026-0305 Use-after-free when XML includes have duplicated entities
Librsvg uses libxml2, a C library, to parse XML. When librsvg parses an SVG document which has a nested Xinclude, an XML entity declaration with a duplicate name as an existing one can cause a use-after-free error. While libxml2 is expanding an internal entity, a recursive XInclude can parse...
Use After Free
Overview sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images Affected versions of this package are vulnerable to Use After Free in entityinsert and the entity map held on XmlState, which is shared between the outer parse an...
SUSE CVE-2026-86144
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...
CVE-2026-86144
A flaw in libxml2's XInclude processing xmlXIncludeProcess and xmlXIncludeProcessTree fails to propagate parser flags like XMLPARSENONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery SSRF, XML External Entity XXE...