Lucene search

K

8 matches found

CVE
CVE
added 2018/07/19 1:29 p.m.281 views

CVE-2018-14404

A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vuln...

7.5CVSS6.3AI score0.2363EPSS
CVE
CVE
added 2018/02/07 11:29 p.m.269 views

CVE-2017-5130

An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file.

8.8CVSS6.6AI score0.00905EPSS
CVE
CVE
added 2018/08/28 7:29 p.m.255 views

CVE-2017-15412

Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

8.8CVSS7AI score0.03481EPSS
CVE
CVE
added 2018/02/19 7:29 p.m.173 views

CVE-2017-7376

Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.

10CVSS8.1AI score0.39544EPSS
CVE
CVE
added 2018/04/08 5:29 p.m.162 views

CVE-2017-18258

The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.

6.5CVSS5.9AI score0.00724EPSS
CVE
CVE
added 2018/02/19 7:29 p.m.133 views

CVE-2017-7375

A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not u...

9.8CVSS6.9AI score0.00262EPSS
CVE
CVE
added 2018/08/16 8:29 p.m.63 views

CVE-2016-9598

libxml2, as used in Red Hat JBoss Core Services, allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted XML document. NOTE: this vulnerability exists because of a missing fix for CVE-2016-4483.

6.5CVSS7.1AI score0.01115EPSS
CVE
CVE
added 2018/08/16 8:29 p.m.51 views

CVE-2016-9596

libxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause a denial of service (stack consumption) via a crafted XML document. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-3627.

6.5CVSS7.2AI score0.00673EPSS