Summary
It was discovered that libxml2 incorrectly handled certain memory
operations. A remote attacker could use this issue to cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2022-49043)
It was discovered that the libxml2 xmllint tool incorrectly handled
certain memory operations. If a user or automated system were tricked into
running xmllint on a specially crafted xml file, a remote attacker could
cause xmllint to crash, resulting in a denial of service. (CVE-2024-34459)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | libxml2 | 2.9.10+dfsg-5ubuntu0.20.04.8 |
| Ubuntu · 22.04 LTS 22.04:LTS | libxml2 | 2.9.13+dfsg-1ubuntu0.5 |
| Ubuntu · 24.04 LTS 24.04:LTS | libxml2 | 2.9.14+dfsg-1.3ubuntu3.1 |
Vulnerabilities 2
-
High 8.1
xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.
-
High 7.5
An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages wit…