A vulnerability was found in the libxml2 library. The parser would fetch content of an external entity while not in validating mode.
References:
https://bugzilla.gnome.org/showbug.cgi?id=761430
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=b1d34de46a11323fccffa9fadeb33be670d602f5
A vulnerability was found in the libxml2 library. There exist a possible format string vulnerability.
https://bugzilla.gnome.org/showbug.cgi?id=761029
Upstream fixes:
https://git.gnome.org/browse/libxml2/commit/?id=4472c3a5a5b516aaf59b89be602fbce52756c3e9 https://git.gnome.org/browse/libxml2/commit/?id=502f6a6d08b08c04b3ddfb1cd21b2f699c1b7f5b
A vulnerability was found in the libxml2 library. A maliciously crafted file could cause the application to crash due to a heap-based buffer underread in xmlParseName.
References:
https://bugzilla.gnome.org/showbug.cgi?id=759573
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=00906759053986b8079985644172085f74331f83
A vulnerability was found in the libxml2 library. A maliciously crafted file could cause the application to crash due to a Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral
References:
https://bugzilla.gnome.org/showbug.cgi?id=760263
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=11ed4a7a90d5ce156a18980a4ad4e53e77384852
A vulnerability was found in the libxml2 library. A maliciously crafted file could cause the application to crash due to a heap-based out-of-bounds memory read.
References:
https://bugzilla.gnome.org/showbug.cgi?id=758606
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=0bcd05c5cd83dec3406c8f68b769b1d610c72f76
A vulnerability was found in the libxml2 library. A heap-use-after free can happen in the xmlDictComputeFastKey.
References:
https://bugzilla.gnome.org/showbug.cgi?id=759398
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=45752d2c334b50016666d8f0ec3691e2d680f0a0
A vulnerability was found in the libxml2 library. A heap-buffer-overflow could happen in xmlStrncat.
References:
https://bugzilla.gnome.org/showbug.cgi?id=763071
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=8fbbf5513d609c1770b391b99e33314cd0742704
A vulnerability was found in the libxml2 library. A heap-buffer overflow could happen in xmlFAParsePosCharGroup
References:
https://bugzilla.gnome.org/showbug.cgi?id=757711
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=cbb271655cadeb8dbb258a64701d9a3a0c4835b4
A vulnerability was found in the libxml2 library. A heap-based buffer overread could happen in xmlParserPrintFileContextInternal
References:
https://bugzilla.gnome.org/showbug.cgi?id=758588
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=db07dd613e461df93dde7902c6505629bf0734e9
The xslextfunctionphp function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml2 before 2.9.2 is used, does not consider the possibility of a NULL valuePop return value before proceeding with a free operation after the principal argument loop, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted XML document, a different vulnerability than CVE-2015-6837.
The xslextfunctionphp function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml2 before 2.9.2 is used, does not consider the possibility of a NULL valuePop return value before proceeding with a free operation during initial error checking, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted XML document, a different vulnerability than CVE-2015-6838.
A vulnerability was found in libxml2. Parsing a maliciously crafted xml file could cause the application to crash if recover mode is used.
References:
http://seclists.org/oss-sec/2016/q2/195
It is possible to trigger a stack overflow using a carefully crafted invalid xml file, the stack overflow occurs before libxml2 determines the xml file is invalid.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=765207
It was found that Red Hat JBoss Core Services erratum RHSA-2016:2957 for CVE-2016-3705 did not actually include the fix for the issue found in libxml2, making it vulnerable to a Denial of Service attack due to a Stack Overflow. This is a regression CVE for the same issue as CVE-2016-3705.
dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the "<!DOCTYPE html" substring in a crafted HTML document.
It was found that Red Hat JBoss Core Services incorrectly fixed CVE-2016-3627 in Apache HTTP 2.4.23 (erratum RHSA-2016:2957), leaving libxml2 vulnerable to a Denial of Service attack via stack consumption.
An out-of-bounds read flaw was reported in libxml2's htmlParseNameComplex() function:
http://seclists.org/oss-sec/2016/q1/199
A remote attacker could provide a specially crafted XML file that, when processed by an application linked against libxml2, could cause the application to disclose crash.
libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities.
The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941.
Stack-based buffer overread vulnerability with HTML parser in push mode in xmlSAX2TextNode causing segmentation fault when compiled with ASAN.
Upstream bug (containing reproducer):
https://bugzilla.gnome.org/showbug.cgi?id=756372
A heap-based buffer overflow read in xmlParseMisc was found.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=756525
A buffer overread in xmlNextChar was found, causing segmentation fault when compiled with ASAN.
Upstream bug (contains reproducer):
https://bugzilla.gnome.org/showbug.cgi?id=756263
Upstream patch:
https://git.gnome.org/browse/libxml2/commit/?id=ab2b9a93ff19cedde7befbf2fcc48c6e352b6cbe
An out-of-bounds heap read in xmlParseXMLDecl happens when a file containing unfinished xml declaration, e.g. <?xml versionencoding="ISO88598", is followed by 0xff byte.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=751631
Upstream patch:
https://git.gnome.org/browse/libxml2/commit/?id=709a952110e98621c9b78c4f26462a9d8333102e
Out-of-bounds heap read also occurs in xmlParseXMLDecl when file contains unterminated encoding value.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=751603
Upstream patch:
https://git.gnome.org/browse/libxml2/commit/?id=9aa37588ee78a06ca1379a9d9356eab16686099c
A heap-based buffer overflow was found in xmlGROW allowing the attacker to read the memory out of bounds.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=756479
Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors related to extracting errors after an encoding conversion failure.
A heap-based buffer overflow vulnerability was found in xmlDictComputeFastQKey in dict.c.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=756528
A vulnerability in libxml2 was found causing DoS by exhausting CPU when parsing specially crafted XML document.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=756733
IssueDescription:
A denial of service flaw was found in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, would lead to excessive CPU consumption (denial of service) based on excessive entity substitutions, even if entity substitution was disabled, which is the parser default behavior.
Multiple use-after-free vulnerabilities in libxml2 2.9.0 and possibly other versions might allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to the (1) htmlParseChunk and (2) xmldecldone functions, as demonstrated by a buffer overflow in the xmlBufGetInputBase function.
A denial of service flaw was found in the way libxml2, a library providing support to read, modify and write XML and HTML files, performed string substitutions when entity values for external entity references replacement (--noent option) was requested / enabled during the XML file parsing. A remote attacker could provide a specially-crafted XML file containing an external entity expansion, when processed would lead to excessive CPU consumption (denial of service).
This a different flaw from CVE-2013-0338.
Upstream patch:
http://git.gnome.org/browse/libxml2/commit/?id=23f05e0c33987d6605387b300c4be5da2120a7ab