A vulnerability was found in the libxml2 library. There exist a possible format string vulnerability.

https://bugzilla.gnome.org/showbug.cgi?id=761029

Upstream fixes:

https://git.gnome.org/browse/libxml2/commit/?id=4472c3a5a5b516aaf59b89be602fbce52756c3e9 https://git.gnome.org/browse/libxml2/commit/?id=502f6a6d08b08c04b3ddfb1cd21b2f699c1b7f5b

Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a long XML entity name.

An integer overflow, leading to heap-based buffer overflow was found in the way libxml, XML files manipulation library, processed certain XPath expressions. A remote attacker could provide a specially-crafted XML file, which once opened in an application linked against libxml would cause that application to crash, or, potentially, execute arbitrary code with the privileges of the user running the application.

References: [1] http://scarybeastsecurity.blogspot.com/2011/05/libxml-vulnerability-and-interesting.html [2] http://www.openwall.com/lists/oss-security/2011/05/31/5 [3] http://www.openwall.com/lists/oss-security/2011/05/31/8

Upstream patch: [4] http://git.gnome.org/browse/libxml2/commit/?id=d7958b21e7f8c447a26bb2436f08402b2c308be4

A vulnerability was found in the libxml2 library. A heap-buffer overflow could happen in xmlFAParsePosCharGroup

References:

https://bugzilla.gnome.org/showbug.cgi?id=757711

Upstream fix:

https://git.gnome.org/browse/libxml2/commit/?id=cbb271655cadeb8dbb258a64701d9a3a0c4835b4

A vulnerability was found in the libxml2 library. A maliciously crafted file could cause the application to crash due to a heap-based buffer underread in xmlParseName.

References:

https://bugzilla.gnome.org/showbug.cgi?id=759573

Upstream fix:

https://git.gnome.org/browse/libxml2/commit/?id=00906759053986b8079985644172085f74331f83

A vulnerability was found in libxml2. Parsing a maliciously crafted xml file could cause the application to crash if recover mode is used.

References:

http://seclists.org/oss-sec/2016/q2/195

It is possible to trigger a stack overflow using a carefully crafted invalid xml file, the stack overflow occurs before libxml2 determines the xml file is invalid.

Upstream bug:

https://bugzilla.gnome.org/showbug.cgi?id=765207

It was found that Red Hat JBoss Core Services erratum RHSA-2016:2957 for CVE-2016-3705 did not actually include the fix for the issue found in libxml2, making it vulnerable to a Denial of Service attack due to a Stack Overflow. This is a regression CVE for the same issue as CVE-2016-3705.

Multiple use-after-free vulnerabilities in libxml2 2.9.0 and possibly other versions might allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to the (1) htmlParseChunk and (2) xmldecldone functions, as demonstrated by a buffer overflow in the xmlBufGetInputBase function.

dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the "<!DOCTYPE html" substring in a crafted HTML document.

The xslextfunctionphp function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml2 before 2.9.2 is used, does not consider the possibility of a NULL valuePop return value before proceeding with a free operation after the principal argument loop, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted XML document, a different vulnerability than CVE-2015-6837.

The xslextfunctionphp function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml2 before 2.9.2 is used, does not consider the possibility of a NULL valuePop return value before proceeding with a free operation during initial error checking, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted XML document, a different vulnerability than CVE-2015-6838.

A vulnerability was found in the libxml2 library. The parser would fetch content of an external entity while not in validating mode.

References:

https://bugzilla.gnome.org/showbug.cgi?id=761430

Upstream fix:

https://git.gnome.org/browse/libxml2/commit/?id=b1d34de46a11323fccffa9fadeb33be670d602f5

A vulnerability in libxml2 was found causing DoS by exhausting CPU when parsing specially crafted XML document.

Upstream bug:

https://bugzilla.gnome.org/showbug.cgi?id=756733

It was discovered, that libxml2 does not properly handle long XML entity names. In the xmlParseAttValueComplex() function in parser.c, when entity name is not substituted with entity value, but is sent to output unchanged, buffer used to store entity name may not be grown sufficiently in case of long entity names, resulting in a heap buffer overflow.

Issue is already fixed upstream in version 2.7.0.

A heap-buffer overflow was found in the way libxml2 decoded certain XML entitites. A remote attacker could provide a specially-crafted XML file, which once opened in an application linked against libxml would cause that application to crash, or, potentially, execute arbitrary code with the privileges of the user running the application.

Reference: http://googlechromereleases.blogspot.in/2012/11/stable-channel-update.html

Patch: http://git.gnome.org/browse/libxml2/commit/?id=6a36fbe3b3e001a8a840b5c1fdd81cefc9947f0d

A denial of service flaw was found in the way libxml2, a library providing support to read, modify and write XML and HTML files, performed string substitutions when entity values for external entity references replacement (--noent option) was requested / enabled during the XML file parsing. A remote attacker could provide a specially-crafted XML file containing an external entity expansion, when processed would lead to excessive CPU consumption (denial of service).

This a different flaw from CVE-2013-0338.

Upstream patch:

http://git.gnome.org/browse/libxml2/commit/?id=23f05e0c33987d6605387b300c4be5da2120a7ab

The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941.

It was found that Red Hat JBoss Core Services incorrectly fixed CVE-2016-3627 in Apache HTTP 2.4.23 (erratum RHSA-2016:2957), leaving libxml2 vulnerable to a Denial of Service attack via stack consumption.

Daniel Veillard discovered that a specially crafted document can lead to a recursive evaluation of entities, the result being an exhaustion of memory and CPU usage

Acknowledgements:

Red Hat would like to thank Andreas Solberg for responsibly disclosing this issue.

Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing framework.

An out-of-bounds read flaw was reported in libxml2's htmlParseNameComplex() function:

http://seclists.org/oss-sec/2016/q1/199

A remote attacker could provide a specially crafted XML file that, when processed by an application linked against libxml2, could cause the application to disclose crash.

A buffer overread in xmlNextChar was found, causing segmentation fault when compiled with ASAN.

Upstream bug (contains reproducer):

https://bugzilla.gnome.org/showbug.cgi?id=756263

Upstream patch:

https://git.gnome.org/browse/libxml2/commit/?id=ab2b9a93ff19cedde7befbf2fcc48c6e352b6cbe

Stack-based buffer overread vulnerability with HTML parser in push mode in xmlSAX2TextNode causing segmentation fault when compiled with ASAN.

Upstream bug (containing reproducer):

https://bugzilla.gnome.org/showbug.cgi?id=756372

A vulnerability was found in the libxml2 library. A maliciously crafted file could cause the application to crash due to a Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral

References:

https://bugzilla.gnome.org/showbug.cgi?id=760263

Upstream fix:

https://git.gnome.org/browse/libxml2/commit/?id=11ed4a7a90d5ce156a18980a4ad4e53e77384852

A vulnerability was found in the libxml2 library. A maliciously crafted file could cause the application to crash due to a heap-based out-of-bounds memory read.

References:

https://bugzilla.gnome.org/showbug.cgi?id=758606

Upstream fix:

https://git.gnome.org/browse/libxml2/commit/?id=0bcd05c5cd83dec3406c8f68b769b1d610c72f76

A vulnerability was found in the libxml2 library. A heap-use-after free can happen in the xmlDictComputeFastKey.

References:

https://bugzilla.gnome.org/showbug.cgi?id=759398

Upstream fix:

https://git.gnome.org/browse/libxml2/commit/?id=45752d2c334b50016666d8f0ec3691e2d680f0a0

A vulnerability was found in the libxml2 library. A heap-based buffer overread could happen in xmlParserPrintFileContextInternal

References:

https://bugzilla.gnome.org/showbug.cgi?id=758588

Upstream fix:

https://git.gnome.org/browse/libxml2/commit/?id=db07dd613e461df93dde7902c6505629bf0734e9

libxml2 before 2.8.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data.

IssueDescription:

A denial of service flaw was found in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, would lead to excessive CPU consumption (denial of service) based on excessive entity substitutions, even if entity substitution was disabled, which is the parser default behavior.