UBUNTU-CVE-2018-14404

A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATHOPAND or XPATHOPOR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerab...

libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate() function in xpath.c

A use-after-free flaw was found in the libxml2 library. An attacker could use this flaw to cause an application linked against libxml2 to crash when parsing a specially crafted XML file...

USN-3513-1: libxml2 vulnerability

It was discovered that libxml2 incorrecty handled certain files. An attacker could use this issue with specially constructed XML data to cause libxml2 to consume resources, leading to a denial of service...

USN-3504-2: libxml2 vulnerability

USN-3504-1 fixed a vulnerability in libxml2. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: Wei Lei discovered that libxml2 incorrecty handled certain parameter entities. An attacker could use this issue with specially constructed XML data to cause...

DEBIAN-CVE-2017-9047

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlenbuf. If the content-type is...

DEBIAN-CVE-2017-8872

The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service buffer over-read or information disclosure...

PT-2017-4234

Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.9.5 Description The issue is related to infinite recursion in parameter entities, which can be exploited by a remote attacker to cause a denial of service. Recommendations For versions prior to 2.9.5, update to...

F5 Networks BIG-IP : Expat XML library vulnerability (K50459349)

Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283. CVE-2015-2716 C Tenable Network...

Critical Flaw in ESET Antivirus Exposes Mac Users to Remote Hacking

What could be more exciting for hackers than exploiting a vulnerability in a widely used software without having to struggle too much? One such easy-to-exploit, but critical vulnerability has been discovered in ESET's antivirus software that could allow any unauthenticated attackers to remotely...

F5 BIG-IP - Expat XML library vulnerability CVE-2016-5300

F5 BIG-IP is prone to a vulnerability in the Expat XML library. This VT has been deprecated as a duplicate of the VT SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

F5 Networks BIG-IP : Expat XML library vulnerability (K70938105)

The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service CPU consumption via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876...

SOL70938105 - Expat XML library vulnerability CVE-2016-5300

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

SOL22232964 - Expat XML library vulnerability CVE-2016-4472

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

PT-2016-3449 · Xmlsoft +9 · Libxml2 +9

Name of the Vulnerable Software and Affected Versions: libxml2 affected versions not specified Description: The issue is related to a possible cross-site scripting vulnerability in libxml2. This vulnerability may allow a remote attacker to access and compromise confidential data. The vulnerabilit...

UBUNTU-CVE-2016-5131

Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function...

PT-2016-3245 · Apache · Apache Xml-Rpc Library

Name of the Vulnerable Software and Affected Versions: Apache XML-RPC library version 3.1.3 Description: The issue is related to an XML external entity XXE vulnerability in the Apache XML-RPC library. This vulnerability allows remote attackers to conduct server-side request forgery SSRF attacks v...

The vulnerability of the enterprise automation system 1C:Enterprise, which allows a malicious individual to cause service failures

The 1C:Enterprise system contains a vulnerability in the Fast Infoset decoder of the xml2.dll library, which is used for working with XML documents. A malicious individual can manipulate input data, causing the Fast Infoset decoder to become in the EIIINDEXLARG state. This allows them to send an...

The vulnerability of the enterprise automation system 1C:Enterprise allows a malicious individual to trigger service failures or execute arbitrary codes.

The automation system of the enterprise 1C:Enterprise contains a vulnerability in the Fast Infoset decoder of the XML document handling library xml2.dll. A malicious individual, by manipulating input data, can set the Fast Infoset decoder to the CIIUTF8LARGELENGTH state for processing a single...

The vulnerability of the PHP interpreter, allowing attackers to execute XXE and XXL attacks

The vulnerability of the ext/libxml/libxml.c file in the PHP interpreter arises from the fact that, when using PHP-FPM, the isolation of individual data threads is not properly implemented. Exploiting this vulnerability allows a remote attacker to execute XXE and XXL attacks using a specially...

UBUNTU-CVE-2016-4449

XML external entity XXE vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or cause a denial of service resource consumption via unspecified vectors...