Moderate: libxml2 security update (Oracle Linux 7)

Summary

Fixed packages 4

Vulnerabilities 6

• High 8.8
  CVE-2016-5131

  Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote atta…

  chromium-browser oxide-qt libxml2 libxml2 Debian Ubuntu Alpine
  Jul 23, 2016
• High 8.8
  CVE-2017-15412

  Nokogiri gem, via libxml, is affected by DoS vulnerabilities

  Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

  chromium-browser oxide-qt libxml2 libxml2 Browsers Debian Ubuntu RubyGems
  Aug 28, 2018
• Medium 6.5
  CVE-2017-18258

  Uncontrolled resource consumption in nokogiri

  The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate fi…

  libxml2 libxml2 nokogiri Debian Ubuntu RubyGems
  Apr 8, 2018
• Medium 6.5
  CVE-2018-14404

  Nokogiri NULL Pointer Dereference

  A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with th…

  libxml2 libxml2 nokogiri libxml2 Debian Ubuntu Alpine RubyGems
  Jul 19, 2018
• Unscored —
  CVE-2015-8035

  The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-de…

  libxml2 libxml2 Debian Ubuntu
  Nov 18, 2015
• Unscored —
  CVE-2018-14567

  libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a craft…

  libxml2 libxml2 libxml2 Debian Ubuntu Alpine
  Aug 16, 2018