Description
Multiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other versions, may allow remote attackers to execute arbitrary code via (1) a long FTP URL that is not properly handled by the xmlNanoFTPScanURL function, (2) a long proxy URL containing FTP data that is not properly handled by the xmlNanoFTPScanProxy function, and other overflows related to manipulation of DNS length values, including (3) xmlNanoFTPConnect, (4) xmlNanoHTTPConnectHost, and (5) xmlNanoHTTPConnectHost.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | libxml +1 | 1:1.8.17-9.2 | RHSA-2004:650 |
| RHEL 3 | libxml2 +2 | 2.5.10-7 | RHSA-2004:615 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Libxml2 - Multiple Remote Stack Buffer Overflow Vulnerabilities EDB-24704 · remote · Oct 26, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2004:650 Red Hat Security Advisory: libxml security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2004:615 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-582-1 libxml - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- APPLE-SA-2005-01-25 vendor-advisory
- 20041026 libxml2 remote buffer overflows (not in xml parsing code though) mailing-list
- P-029 third-party-advisory government-resource
- 11179 vdb-entry
- 1011941 vdb-entry
- RHSA-2004:615 vendor-advisory
- 11526 vdb-entry
- oval:org.mitre.oval:def:10505 vdb-entry signature
- libxml2-nanoftp-file-bo(17872) vdb-entry
- RHSA-2004:650 vendor-advisory
- GLSA-200411-05 vendor-advisory
- CLA-2004:890 vendor-advisory
- 11324 vdb-entry
- SUSE-SR:2005:001 vendor-advisory
- oval:org.mitre.oval:def:1173 vdb-entry signature
- USN-89-1 vendor-advisory
- 13000 third-party-advisory
- DSA-582 vendor-advisory
- libxml2-xmlnanoftpscanurl-bo(17870) vdb-entry
- libxml2-xmlnanoftpscanproxy-bo(17875) vdb-entry
- 11180 vdb-entry
- libxml2-nanohttp-file-bo(17876) vdb-entry