ALPINE-CVE-2022-29824

In libxml2 before 2.9.14, several buffer handling functions in buf.c xmlBuf and tree.c xmlBuffer don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer...

CVE-2022-24836

CVE-2022-24836 affects Nokogiri, a Ruby HTML/XML parser. The issue is an inefficient regular expression used to detect encoding in HTML documents in versions = 1.13.4 (or applicable patches) as noted in multiple sources (Debian/Alpine/Amazon/DLA advisories and vendor notices). If upgrade is not p...

JOX 代码问题漏洞

JOX is a set of Java libraries. You can easily transfer data between XML documents and Java beans. JOX 1.16 version of the JOXSAXBeanInput module has a security vulnerability , the vulnerability stems from the JOXSAXBeanInput module's readObject method of the XML External Entity XXE: XML External...

PT-2022-2584

Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.9.14 libxslt versions prior to 1.1.35 Description The issue is related to integer overflows in several buffer handling functions in buf.c xmlBuf and tree.c xmlBuffer of the libxml2 library. This can result in...

CVE-2021-3596

A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage in coders/svg.c. This issue is due to not checking the return value from libxml2's xmlCreatePushParserCtxt and uses the value directly, which leads to a crash and segmentation fault...

PYSEC-2021-852

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant...

ALPINE-CVE-2021-3541

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service...

libxml2: Use-after-free in xmlEncodeEntitiesInternal() in entities.c

There's a flaw in libxml2's xmllint. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability...

Debian DLA-2669-1 : libxml2 security update

An issue has been found in libxml2, the GNOME XML library. This issue is called 'Parameter Laughs'-attack and is related to parameter entities expansion. It is similar to the 'Billion Laughs'-attacks found earlier in libexpat. More information can be found at 1 1...

Debian: Security Advisory (DLA-2669-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RLSA-2020:4484 Moderate: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: large number of colons in input makes parser consume high amount of resources, leading to DoS CVE-2018-20843 expat: heap-based buffer over-read via crafted XML input CVE-2019-15903 For more details about the security issues,...

CVE-2019-8756

Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Catalina 10.15, iOS 13, iCloud for Windows 7.14, iCloud for Windows 10.7, tvOS 13, macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, watchOS 6, iTunes 12.10....

Debian DLA-2369-1 : libxml2 security update

Several security vulnerabilities were corrected in libxml2, the GNOME XML library. CVE-2017-8872 Global buffer-overflow in the htmlParseTryOrFinish function. CVE-2017-18258 The xzhead function in libxml2 allows remote attackers to cause a denial of service memory consumption via a crafted LZMA...

libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c

A null pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval function of libxml2 when parsing invalid XPath expression. Applications processing untrusted XSL format inputs with the use of libxml2 library may be vulnerable to denial of service attack due to crash of the...

ALPINE-CVE-2019-20388

xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak...

The vulnerability in the library of MSXML used by MatrikonOPC Explorer, a software tool for managing technological processes. This vulnerability allows an attacker to transfer data from the main system and gain access to confidential information.

The vulnerability of the MSXML library used in MatrikonOPC Explorer, a software tool for managing technological processes, is related to security flaws in its mechanisms. Exploiting this vulnerability could allow an attacker, operating locally, to transfer data from the main system and gain acces...

cn.home1:oss-eureka (>=1.0.6.OSS <=1.0.7.OSS), cn.home1:spring-cloud-eureka-server (=1.0.1.U1) +493 more potentially affected by CVE-2016-7051 via com.fasterxml.jackson.dataformat:jackson-dataformat-xml (>=2.8.0 <=2.8.3)

com.fasterxml.jackson.dataformat:jackson-dataformat-xml MAVEN version =2.8.0, =1.0.6.OSS, =A.1.1.1, =2.19.10.0, =1.1.4-RELEASE, =1.1.4-RELEASE, =1.1.4-RELEASE, =1.1.4-RELEASE, =1.1.4-RELEASE, =1.5.0.RELEASE, =1.5.0.RELEASE, =1.5.0.RELEASE, =1.5.1.RELEASE -...

libxml2: Heap-based buffer over-read in function xmlDictComputeFastKey

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398...

USN-3739-2: libxml2 vulnerabilities

USN-3739-1 fixed a vulnerability in libxml2. This update provides the corresponding update for Ubuntu 12.04. Original advisory details: Matias Brutti discovered that libxml2 incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information...

For ASP. NET resource files. RESX and deserialization vulnerability research-exploit warning-the black bar safety net

ASP. NET application resource files are typically used as a localized storage, they can be used to store user interface elements or can be easily translated string to1. These resource files are generally used. resx as the file expansion name, and when they are in. resources as files to expand the...