CLSA-2026-1789668422 libxml2: Fix of 5 CVEs

CVE-2026-86140: add bounds checks around the parenthesis writes in xmlSnprintfElements - CVE-2026-86141: check the xmlStrdup result in xmlRegNewParserCtxt so a failed allocation cannot leave a NULL parser cursor - CVE-2026-86142: make xmlStrlen saturate above INTMAX and reject the saturated...

CLSA-2026-1789668093 libxml2: Fix of 5 CVEs

CVE-2026-86140: add bounds checks around the parenthesis writes in xmlSnprintfElements - CVE-2026-86141: check the xmlStrdup result in xmlRegNewParserCtxt so a failed allocation cannot leave a NULL parser cursor - CVE-2026-86142: make xmlStrlen saturate above INTMAX and reject the saturated...

WS-2019-0559

libxslt before v1.1.34-rc2 is vulnerable to use-of-uninitialized-value in xmlStrlen...

OSV-2020-1056 Use-of-uninitialized-value in xmlStrlen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069 Crash type: Use-of-uninitialized-value Crash state: xmlStrlen xmlBufferAdd xmlBufferCat...

PT-2020-21677

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided input. Description The issue is related to a crash type of Use-of-uninitialized-value. The crash state involves functions such as xmlStrlen, xmlBufferAdd, and xmlBufferCat. No...

PT-2020-21733

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash caused by a use-of-uninitialized-value error. The crash involves the functions xmlStrlen, xmlStrncat, and...

libxslt/xslt: Use-of-uninitialized-value in xmlStrlen

Project: https://gitlab.gnome.org/GNOME/libxslt.git Detailed report: https://oss-fuzz.com/testcase?key=5669481868689408 Project: libxslt Fuzzer: libFuzzerlibxsltxslt Fuzz target binary: xslt Job Type: libfuzzermsanlibxslt Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

libxslt/xslt: Use-of-uninitialized-value in xmlStrlen

Project: https://gitlab.gnome.org/GNOME/libxslt.git Detailed report: https://oss-fuzz.com/testcase?key=5197371471822848 Project: libxslt Fuzzer: libFuzzerlibxsltxslt Fuzz target binary: xslt Job Type: libfuzzermsanlibxslt Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

Heap-Based Buffer Overflow In Libxml2

nokogiri gem is using libxml2 which is vulnerable to CVE-2016-1834. The vulnerability exists when xmlStrlen returns a negative length in the xmlStrncat function. Therefore, it may lead to other attacks such as denial of service or arbitrary code execution through a heap-based buffer overflow usin...