Oracle Linux 9 : libxml2 (ELSA-2023-0338)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-0338 advisory. - Fix CVE-2022-40303 2136564 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus h...

Debian: Security Advisory (DLA-3276-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3276-1] lava security update

Debian LTS Advisory DLA-3276-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany January 19, 2023 https://wiki.debian.org/LTS Package : lava Version : 2019.01-5+deb10u2 CVE ID : CVE-2022-44641 Debian Bug : 1024429 Igor Ponomarev discovered that LAVA, a continuous...

Oracle Linux 8 : libxml2 (ELSA-2023-0173)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-0173 advisory. - Fix CVE-2022-40303 2136562 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus h...

Huawei EulerOS: Security Advisory for libxml2 (EulerOS-SA-2023-1106)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP9 : libxml2 (EulerOS-SA-2023-1106)

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser option enabled, sever...

EulerOS 2.0 SP9 : libxml2 (EulerOS-SA-2023-1130)

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser option enabled, sever...

Amazon Linux 2022 : libxml2 (ALAS2022-2022-258)

The version of libxml2 installed on the remote host is prior to 2.10.3-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-258 advisory. - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE...

The vulnerability of the dynamic data management framework Apache Calcite, related to incorrect restrictions on XML links to external objects, allows attackers to perform XXE attacks.

The vulnerability of the Apache Calcite dynamic data management framework is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks using specially created XML code...

DEBIAN-CVE-2022-40304

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked...

AZL-11500 CVE-2022-40304 affecting package libxml2 for versions less than 2.10.3-1

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked...

CVE-2022-40304

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked...

CVE-2022-40304

CVE-2022-40304: libxml2 before 2.10.3 contains invalid XML entity definitions that can corrupt a hash table key, potentially triggering logic errors and, in at least one case, a double-free. Affected library is libxml2; CVSS v3.1 shows base score 7.8 (HIGH) with LOCAL access, high impact. Public ...

CVE-2022-40304

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked...

CVE-2022-40304

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked...

CVE-2022-40304

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked...

CVE-2022-44641

In Linaro Automated Validation Architecture LAVA before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive use of memory on the server and a Denial of Service...

CVE-2022-40304

A flaw was found in libxml2. When a reference cycle is detected in the XML entity cleanup function the XML entity data can be stored in a dictionary. In this case, the dictionary becomes corrupted resulting in logic errors, including memory errors like double free...

Double Free

libxml2 is vulnerable to double free. When a reference cycle is detected in the XML entity cleanup function the XML entity data can be stored in a dictionary which may become corrupted resulting in logic errors, including memory errors like double free...

CVE-2022-3338

An External XML entity XXE vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side Request Forgery attack. This can be exploited by mimicking the Agent Handler call to ePO and passing the carefully constructed XML file throu...