Summary
Yunho Kim discovered that libxml2 incorrectly handled certain error
conditions. A remote attacker could exploit this with a crafted XML file to
cause a denial of service, or possibly cause libxml2 to expose sensitive
information. This issue only affected Ubuntu 14.04 ESM, and Ubuntu 16.04
ESM. (CVE-2017-8872)
Zhipeng Xie discovered that libxml2 incorrectly handled certain XML
schemas. A remote attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM,
and Ubuntu 18.04 LTS. (CVE-2019-20388)
It was discovered that libxml2 incorrectly handled invalid UTF-8 input. A
remote attacker could possibly exploit this with a crafted XML file to
cause libxml2 to crash, resulting in a denial of service. This issue only
affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, Ubuntu 18.04 LTS, Ubuntu 20.04
LTS and Ubuntu 20.10. (CVE-2020-24977)
It was discovered that libxml2 incorrectly handled invalid UTF-8 input. A
remote attacker could possibly exploit this with a crafted XML file to
cause libxml2 to crash, resulting in a denial of service. (CVE-2021-3517)
It was discovered that libxml2 did not properly handle certain crafted XML
files. A local attacker could exploit this with a crafted input to cause
libxml2 to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2021-3516, CVE-2021-3518)
It was discovered that libxml2 incorrectly handled error states. A remote
attacker could exploit this with a crafted XML file to cause libxml2 to
crash, resulting in a denial of service. (CVE-2021-3537)
Sebastian Pipping discovered that libxml2 did not properly handle certain
crafted XML files. A remote attacker could exploit this with a crafted XML
file to cause libxml2 to crash, resulting in a denial of service. This
issue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04.
(CVE-2021-3541)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | libxml2 | 2.9.4+dfsg1-6.1ubuntu1.4 |
| Ubuntu · 20.04 LTS 20.04:LTS | libxml2 | 2.9.10+dfsg-5ubuntu0.20.04.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | libxml2 | 2.9.1+dfsg1-3ubuntu4.13+esm2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libxml2 | 2.9.3+dfsg1-1ubuntu0.7+esm1 |
Vulnerabilities 8
-
Critical 9.1
The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffe…
-
High 8.8CVE-2021-3518 EPSS 22%
Nokogiri Implements libxml2 version vulnerable to use-after-free
There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, an…
-
High 8.6CVE-2021-3517 EPSS 17%
Nokogiri contains libxml Out-of-bounds Write vulnerability
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds …
-
High 7.5
xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
-
Medium 5.9
Nokogiri Implements libxml2 version vulnerable to null pointer dereferencing
A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used …
-
Unscored —
GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entit…
-
Unscored —
There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be p…
-
Unscored —
A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechani…
References
-
report
https://ubuntu.com/security/CVE-2017-8872
-
report
https://ubuntu.com/security/CVE-2019-20388
-
report
https://ubuntu.com/security/CVE-2020-24977
-
report
https://ubuntu.com/security/CVE-2021-3516
-
report
https://ubuntu.com/security/CVE-2021-3517
-
report
https://ubuntu.com/security/CVE-2021-3518
-
report
https://ubuntu.com/security/CVE-2021-3537
-
report
https://ubuntu.com/security/CVE-2021-3541