Common Vulnerabilities and Exposures assigned an identifier CVE-2003-1564 to the following vulnerability:

libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka the "billion laughs attack."

References: http://www.stylusstudio.com/xmldev/200302/post20020.html http://www.reddit.com/r/programming/comments/65843/timetoupgradelibxml2 http://xmlsoft.org/news.html http://mail.gnome.org/archives/xml/2008-August/msg00034.html

A heap-buffer overflow was found in the way libxml2 decoded certain XML entitites. A remote attacker could provide a specially-crafted XML file, which once opened in an application linked against libxml would cause that application to crash, or, potentially, execute arbitrary code with the privileges of the user running the application.

Reference: http://googlechromereleases.blogspot.in/2012/11/stable-channel-update.html

Patch: http://git.gnome.org/browse/libxml2/commit/?id=6a36fbe3b3e001a8a840b5c1fdd81cefc9947f0d

libxml2 before 2.8.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data.

Common Vulnerabilities and Exposures assigned an identifier CVE-2013-2877 to the following vulnerability:

parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XMLPARSEREOF state.

References: [1] ftp://xmlsoft.org/libxml2/libxml2-2.9.0.tar.gz [2] http://git.chromium.org/gitweb/?p=chromium/chromium.git;a=commit;h=e5d7f7e5dc21d3ae7be3cbb949ac4d8701e06de1 [3] http://googlechromereleases.blogspot.com/2013/07/stable-channel-update.html [4] https://code.google.com/p/chromium/issues/detail?id=229019

Relevant upstream patch: [5] https://git.gnome.org/browse/libxml2/commit/parser.c?id=e50ba8164eee06461c73cd8abb9b46aa0be81869

A denial of service flaw was found in the way libxml2, a library providing support to read, modify and write XML and HTML files, performed string substitutions when entity values for entity references replacement (--noent option) was requested / enabled during the XML file parsing. A remote attacker could provide a specially-crafted XML file that, when processed would lead to excessive CPU consumption (denial of service).