libxml2 - security update

Fixed packages 2

Vulnerabilities 12

• Medium —
  CVE-2015-1819

  Nokogiri vulnerable to libxml XML Entity Expansion

  The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.

  libxml2 libxml2 nokogiri Debian Ubuntu RubyGems
  Aug 14, 2015
• High —
  CVE-2015-5312

  Nokogiri subject to DoS via libxml2 vulnerability

  The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability tha…

  libxml2 libxml2 nokogiri Debian Ubuntu RubyGems
  Dec 15, 2015
• Unscored —
  CVE-2015-7497

  Heap-based buffer overflow in the xmlDictComputeFastQKey function in dict.c in libxml2 before 2.9.3 allows context-depe…

  libxml2 libxml2 Debian Ubuntu
  Dec 15, 2015
• Unscored —
  CVE-2015-7498

  Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent…

  libxml2 libxml2 Debian Ubuntu
  Dec 15, 2015
• Medium —
  CVE-2015-7499

  Heap-based buffer overflow in nokogiri

  Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.

  libxml2 libxml2 nokogiri Debian Ubuntu RubyGems
  Dec 15, 2015
• Unscored —
  CVE-2015-7500

  The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of s…

  libxml2 libxml2 Debian Ubuntu
  Dec 15, 2015
• Unscored —
  CVE-2015-7941

  libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial …

  libxml2 libxml2 Debian Ubuntu
  Nov 18, 2015
• Unscored —
  CVE-2015-7942

  The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it st…

  libxml2 libxml2 Debian Ubuntu
  Nov 18, 2015
• Unscored —
  CVE-2015-8035

  The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-de…

  libxml2 libxml2 Debian Ubuntu
  Nov 18, 2015
• Unscored —
  CVE-2015-8241

  The xmlNextChar function in libxml2 2.9.2 does not properly check the state, which allows context-dependent attackers t…

  libxml2 libxml2 Debian Ubuntu
  Dec 15, 2015
• Unscored —
  CVE-2015-8317

  The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive…

  libxml2 libxml2 Debian Ubuntu
  Dec 15, 2015
• Unscored —
  CVE-2015-8710 Public exploit

  The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a deni…

  libxml2 libxml2 Debian Ubuntu
  Apr 11, 2016