REDHAT-BUG-2519776: Null Pointer Dereference
A NULL pointer dereference flaw was found in libxml2 XML catalog parsing. When a catalog contains a nextCatalog element without the mandatory catalog attribute, xmlParseXMLCatalogOneNode() returns NULL, but the nextCatalog deduplication loop dereferences the entry before the existing NULL check, crashing the application.
Affected Software
Event History
Frequently Asked Questions
What input is required to trigger the crash?
The application must parse an XML catalog containing a nextCatalog element that omits the mandatory catalog attribute. This causes catalog parsing to return NULL and the subsequent deduplication loop dereferences it.
What is the impact of successful exploitation?
The affected application crashes due to a NULL pointer dereference. The provided information supports a denial-of-service impact; it does not indicate code execution or data disclosure.
How can I determine whether an application is exposed?
Identify applications that use libxml2 to parse XML catalogs, then check whether they can be made to process catalogs containing nextCatalog entries. Catalogs with a nextCatalog element lacking its catalog attribute are the relevant malformed input.