PT-2016-4390

Name of the Vulnerable Software and Affected Versions Apache Xerces-C versions prior to 3.1.3 Description The issue is related to multiple buffer overflows in the XML Parser library, specifically in the internal/XMLReader.cpp, util/XMLURL.cpp, and util/XMLUri.cpp files. This can be exploited by...

DLA-433-1 xerces-c - security update

Bulletin has no description...

Cisco MiniUPnP Stack Smashing Protection Attack

The Internet of Things security challenge is twofold: finding bugs, and more urgent—fixing them. Cisco’s Talos security intelligence and research group found and privately disclosed a serious and trivially exploitable client-side bug in MiniUPnP that was patched in September of last year. The...

expat: hash table collisions CPU usage DoS

A denial of service flaw was found in the implementation of hash arrays in Expat. An attacker could use this flaw to make an application using Expat consume an excessive amount of CPU time by providing a specially crafted XML file that triggers multiple hash function collisions. To mitigate this...

OpenJDK: insufficient enforcement of totalEntitySizeLimit (JAXP, 8133962)

It was discovered that the JAXP component in OpenJDK did not properly enforce the totalEntitySizeLimit limit. An attacker able to make a Java application process a specially crafted XML file could use this flaw to make the application consume an excessive amount of memory...

OpenJDK: insufficient enforcement of totalEntitySizeLimit (JAXP, 8133962)

It was discovered that the JAXP component in OpenJDK did not properly enforce the totalEntitySizeLimit limit. An attacker able to make a Java application process a specially crafted XML file could use this flaw to make the application consume an excessive amount of memory...

ownCloud: XXE at host vpn.owncloud.com

Improper XML parser configuration provide attacker to read arbitrary files and make HTTP requests from server side. Exploit example is listed below: POST /user/login HTTP/1.1 Host: 144.76.105.208 Accept: / Content-type: application/xml Accept-Language: en User-Agent: Mozilla/5.0 compatible; MSIE...

libxml2 Denial of Service Vulnerability (CNVD-2015-08400)

libxml2 is an XML parser and markup toolset. A denial of service vulnerability exists in versions of libxml2 prior to 2.9.3. An attacker is able to cause a denial of service via unspecified vectors regarding incorrect entity boundaries and start tags...

libxml2 heap buffer overflow vulnerability (CNVD-2015-08399)

libxml2 is an XML parser and markup toolset. A heap buffer overflow vulnerability exists in libxml2 versions prior to 2.9.3. An attacker is able to context-dependently obtain sensitive process memory information via unspecified vectors...

libxml2 Denial of Service Vulnerability (CNVD-2015-08376)

Libxml2 is the GNOME project team developed a C-based language used to parse XML documents library , which supports a variety of encoding formats , Xpath parsing , Well-formed and valid validation and so on. A security vulnerability exists in the 'xmlSAX2TextNode' function in the SAX2.c file of t...

Cisco Adaptive Security Appliance DoS

The vulnerability of XML parsers in the interface for managing microprogrammed network device software of Cisco Adaptive Security Appliances is related to resource management errors. Exploiting this vulnerability can allow a malicious actor to cause service failures using an specially crafted XML...

Cisco ASA Management Interface XML Parser DoS Vulnerability (cisco-sa-20151123-asa)

A vulnerability in the XML parser of the management interface of Cisco ASA may lead to a denial of service. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

[SECURITY] [DLA 355-1] libxml2 security update

Package : libxml2 Version : 2.7.8.dfsg-2+squeeze15 CVE ID : CVE-2015-8241 CVE-2015-8317 Debian Bug : 806384 CVE-2015-8241 Buffer overread with XML parser in xmlNextChar CVE-2015-8317 - issues in the xmlParseXMLDecl function: If we fail conversing the current input stream while processing the...

DLA-355-1 libxml2 - security update

Bulletin has no description...

Updated libxml2 packages fix security vulnerabilities

Updated libxml2 packages fix security vulnerabilities: In libxml2 before 2.9.3, one case where when dealing with entities expansion, it failed to exit, leading to a denial of service CVE-2015-5312. In libxml2 before 2.9.3, it was possible to hit a negative offset in the name indexing used to...

CVE-2015-6379

The XML parser in the management interface in Cisco Adaptive Security Appliance ASA Software 8.4 allows remote authenticated users to cause a denial of service device crash via a crafted XML document, aka Bug ID CSCut14223...

Design/Logic Flaw

The XML parser in the management interface in Cisco Adaptive Security Appliance ASA Software 8.4 allows remote authenticated users to cause a denial of service device crash via a crafted XML document, aka Bug ID CSCut14223...

CVE-2015-6379

The XML parser in the management interface in Cisco Adaptive Security Appliance ASA Software 8.4 allows remote authenticated users to cause a denial of service device crash via a crafted XML document, aka Bug ID CSCut14223...

CVE-2015-6379: Undefined Security Weakness

The XML parser in the management interface in Cisco Adaptive Security Appliance ASA Software 8.4 allows remote authenticated users to cause a denial of service device crash via a crafted XML document, aka Bug ID CSCut14223...

Cisco ASA Management Interface XML Parser Denial of Service Vulnerability

A vulnerability in the XML parser of the management interface in Cisco Adaptive Security Appliance ASA Software could allow an authenticated, remote attacker to cause system instability and possibly crash an affected system. The vulnerability is due to insufficient hardening of the XML parser cod...