Summary
Matias Brutti discovered that libxml2 incorrectly handled certain XML files.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2016-9318)
It was discovered that libxml2 incorrectly handled certain files.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 18.04 LTS. (CVE-2017-16932)
It was discovered that libxml2 incorrectly handled certain files.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2017-18258, CVE-2018-14404, CVE-2018-14567)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | libxml2 | 2.9.1+dfsg1-3ubuntu4.13 |
| Ubuntu · 16.04 LTS 16.04:LTS | libxml2 | 2.9.3+dfsg1-1ubuntu0.6 |
| Ubuntu · 18.04 LTS 18.04:LTS | libxml2 | 2.9.4+dfsg1-6.1ubuntu1.2 |
Vulnerabilities 5
-
High 7.5
Nokogiri gem, via libxml, is affected by DoS vulnerabilities
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
-
Medium 6.5
Uncontrolled resource consumption in nokogiri
The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate fi…
-
Medium 6.5
Nokogiri NULL Pointer Dereference
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with th…
-
Medium 5.5
libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indi…
-
Unscored —
libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a craft…