libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation

A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure,...

libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation

A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure,...

libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation

A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure,...

libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation

A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure,...

libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation

A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure,...

TencentOS Server 3: libxml2 (TSSA-2026:1217)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1217 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation

A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure,...

libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation

A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure,...

libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation

A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure,...

libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation

A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure,...

CentOS Linux 6 [TuxCare] Security Update: libxml2 / libxml2-devel / libxml2-python / libxml2-static Multiple Vulnerabilities (CENTOS6:CLSA-2026:1789380986)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1789380986 advisory. - In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow. CVE-2026-86138...

CentOS Linux 7 [TuxCare] Security Update: libxml2 / libxml2-devel / libxml2-python / libxml2-static (CENTOS7:CLSA-2026:1789381419)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1789381419 advisory. - In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation...

libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation

A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure,...

libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation

A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure,...

CLSA-2026-1789780589 libxml2: Fix of 5 CVEs

CVE-2026-86140: add bounds checks around the parenthesis writes in xmlSnprintfElements - CVE-2026-86141: check the xmlStrdup result in xmlRegNewParserCtxt so a failed allocation cannot leave a NULL parser cursor - CVE-2026-86142: make xmlStrlen saturate above INTMAX and reject the saturated...

CLSA-2026-1789668422 libxml2: Fix of 5 CVEs

CVE-2026-86140: add bounds checks around the parenthesis writes in xmlSnprintfElements - CVE-2026-86141: check the xmlStrdup result in xmlRegNewParserCtxt so a failed allocation cannot leave a NULL parser cursor - CVE-2026-86142: make xmlStrlen saturate above INTMAX and reject the saturated...

CLSA-2026-1789668093 libxml2: Fix of 5 CVEs

CVE-2026-86140: add bounds checks around the parenthesis writes in xmlSnprintfElements - CVE-2026-86141: check the xmlStrdup result in xmlRegNewParserCtxt so a failed allocation cannot leave a NULL parser cursor - CVE-2026-86142: make xmlStrlen saturate above INTMAX and reject the saturated...

CLSA-2026-1789655873 libxml2: Fix of 4 CVEs

CVE-2026-86140: add the missing bounds checks around the two unguarded strcat calls in xmlSnprintfElements, the sibling of the function fixed for CVE-2025-24928 - CVE-2026-86142: reject a saturated xmlStrlen result in xmlXPtrEvalXPtrPart before it is used to size the XPointer buffer -...

CLSA-2026-1789601376 Fix CVE(s): CVE-2026-86142, CVE-2026-86143, CVE-2026-86144

SECURITY UPDATE: heap buffer overflow in xmlXPtrEvalXPtrPart on oversized xpointer expressions - debian/patches/CVE-2026-86142.patch: make xmlStrlen in xmlstring.c saturate above INTMAX and reject the saturated length in xmlXPtrEvalXPtrPart in xpointer.c before sizing the buffer - CVE-2026-86142...

CLSA-2026-1789380986 libxml2: Fix of 3 CVEs

CVE-2026-86138: add overflow checks to xmlDictAddQString pool size calculation and bound the QName lengths in its caller xmlDictQLookup to prevent heap buffer overflow when interning long QNames - CVE-2026-86140: add bounds checks around the englobing parenthesis strcat calls in...