NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.
GNOME libxml2 is vulnerable to a buffer overflow, caused by improper bounds checking by the xmlEncodeEntitiesInternal function in libxml2/entities.c. By persuading a victim to open a specially-crafted file, a remote attacker could overflow a buffer and execute arbitrary code on the system.
Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.
A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).
The libxml2 library, as used in multiple products, could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruption error. An attacker could exploit this vulnerability using a specially crafted XML document to execute arbitrary code on the system or cause a denial of service.
A vulnerability was found in the libxml2 library. The parser would fetch content of an external entity while not in validating mode.
References:
https://bugzilla.gnome.org/showbug.cgi?id=761430
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=b1d34de46a11323fccffa9fadeb33be670d602f5
A vulnerability was found in the libxml2 library. There exist a possible format string vulnerability.
https://bugzilla.gnome.org/showbug.cgi?id=761029
Upstream fixes:
https://git.gnome.org/browse/libxml2/commit/?id=4472c3a5a5b516aaf59b89be602fbce52756c3e9 https://git.gnome.org/browse/libxml2/commit/?id=502f6a6d08b08c04b3ddfb1cd21b2f699c1b7f5b
A vulnerability was found in the libxml2 library. A maliciously crafted file could cause the application to crash due to a heap-based buffer underread in xmlParseName.
References:
https://bugzilla.gnome.org/showbug.cgi?id=759573
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=00906759053986b8079985644172085f74331f83
A vulnerability was found in the libxml2 library. A maliciously crafted file could cause the application to crash due to a Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral
References:
https://bugzilla.gnome.org/showbug.cgi?id=760263
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=11ed4a7a90d5ce156a18980a4ad4e53e77384852
A vulnerability was found in the libxml2 library. A maliciously crafted file could cause the application to crash due to a heap-based out-of-bounds memory read.
References:
https://bugzilla.gnome.org/showbug.cgi?id=758606
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=0bcd05c5cd83dec3406c8f68b769b1d610c72f76
A vulnerability was found in the libxml2 library. A heap-use-after free can happen in the xmlDictComputeFastKey.
References:
https://bugzilla.gnome.org/showbug.cgi?id=759398
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=45752d2c334b50016666d8f0ec3691e2d680f0a0
A vulnerability was found in the libxml2 library. A heap-buffer-overflow could happen in xmlStrncat.
References:
https://bugzilla.gnome.org/showbug.cgi?id=763071
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=8fbbf5513d609c1770b391b99e33314cd0742704
A vulnerability was found in the libxml2 library. A heap-buffer overflow could happen in xmlFAParsePosCharGroup
References:
https://bugzilla.gnome.org/showbug.cgi?id=757711
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=cbb271655cadeb8dbb258a64701d9a3a0c4835b4
A vulnerability was found in the libxml2 library. A heap-based buffer overread could happen in xmlParserPrintFileContextInternal
References:
https://bugzilla.gnome.org/showbug.cgi?id=758588
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=db07dd613e461df93dde7902c6505629bf0734e9
A vulnerability was found in the libxml2 library. A heap-based buffer overread could happen in xmlDictAddString.
References:
https://bugzilla.gnome.org/showbug.cgi?id=758605
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=a820dbeac29d330bae4be05d9ecd939ad6b4aa33
The xslextfunctionphp function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml2 before 2.9.2 is used, does not consider the possibility of a NULL valuePop return value before proceeding with a free operation after the principal argument loop, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted XML document, a different vulnerability than CVE-2015-6837.
The xslextfunctionphp function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml2 before 2.9.2 is used, does not consider the possibility of a NULL valuePop return value before proceeding with a free operation during initial error checking, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted XML document, a different vulnerability than CVE-2015-6838.
A vulnerability was found in libxml2. Parsing a maliciously crafted xml file could cause the application to crash if recover mode is used.
References:
http://seclists.org/oss-sec/2016/q2/195
It is possible to trigger a stack overflow using a carefully crafted invalid xml file, the stack overflow occurs before libxml2 determines the xml file is invalid.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=765207
It was found that Red Hat JBoss Core Services erratum RHSA-2016:2957 for CVE-2016-3705 did not actually include the fix for the issue found in libxml2, making it vulnerable to a Denial of Service attack due to a Stack Overflow. This is a regression CVE for the same issue as CVE-2016-3705.
dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the "<!DOCTYPE html" substring in a crafted HTML document.
The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of-bounds heap memory access and application crash), or possibly have unspecified other impact via an unclosed HTML comment.
A vulnerability was found in a way libxml2 parses certain files. With the libxml2 in recovery mode, a maliciously crafted filed could cause libxml2 to crash.
References:
http://seclists.org/oss-sec/2016/q1/682
CVE assignment:
http://seclists.org/oss-sec/2016/q1/683
It was found that Red Hat JBoss Core Services incorrectly fixed CVE-2016-3627 in Apache HTTP 2.4.23 (erratum RHSA-2016:2957), leaving libxml2 vulnerable to a Denial of Service attack via stack consumption.
An out-of-bounds read flaw was reported in libxml2's htmlParseNameComplex() function:
http://seclists.org/oss-sec/2016/q1/199
A remote attacker could provide a specially crafted XML file that, when processed by an application linked against libxml2, could cause the application to disclose crash.
libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities.
The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941.
Stack-based buffer overread vulnerability with HTML parser in push mode in xmlSAX2TextNode causing segmentation fault when compiled with ASAN.
Upstream bug (containing reproducer):
https://bugzilla.gnome.org/showbug.cgi?id=756372
A heap-based buffer overflow read in xmlParseMisc was found.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=756525
A buffer overread in xmlNextChar was found, causing segmentation fault when compiled with ASAN.
Upstream bug (contains reproducer):
https://bugzilla.gnome.org/showbug.cgi?id=756263
Upstream patch:
https://git.gnome.org/browse/libxml2/commit/?id=ab2b9a93ff19cedde7befbf2fcc48c6e352b6cbe