Vulnerabilidades de Xmlsoft

CVE-2020-24977 Média · 6.5 CWE-125 03/09/2020

GNOME project libxml2 v2.9.10 and earlier have a global Buffer Overflow vulnerability in...

GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.

CVE-2020-7595 Alta · 7.5 CWE-835 21/01/2020

libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

CVE-2019-20388 Alta · 7.5 CWE-401 21/01/2020

xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.

CVE-2019-19956 Alta · 7.5 CWE-401 24/12/2019

xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related...

xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.

CVE-2018-14567 Média · 6.5 CWE-835 16/08/2018

Infinite Loop em Xmlsoft Libxml2

libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.

CVE-2018-14404 Média · 6.5 CWE-476 19/07/2018

Nokogiri NULL Pointer Dereference

A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.

CVE-2017-18258 Média · 6.5 CWE-770 08/04/2018

Uncontrolled resource consumption in nokogiri

The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.

CVE-2017-7376 Crítica · 9.8 CWE-119 19/02/2018

Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an...

Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.

CVE-2017-7375 Crítica · 9.8 CWE-611 19/02/2018

A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the...

A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).

CVE-2017-16932 Alta · 7.5 CWE-835 23/11/2017

Nokogiri gem, via libxml, is affected by DoS vulnerabilities

parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.

CVE-2017-16931 Crítica · 9.8 CWE-119 23/11/2017

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro...

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.

CVE-2017-9050 Alta · 7.5 CWE-125 18/05/2017

Out-of-bounds read in nokogiri

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.

CVE-2017-9049 Alta · 7.5 CWE-125 18/05/2017

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the...

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.

CVE-2017-9048 Alta · 7.5 CWE-119 18/05/2017

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function...

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash.

CVE-2017-9047 Alta · 7.5 CWE-119 18/05/2017

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function...

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.

CVE-2016-9318 Média · 5.5 CWE-611 15/11/2016

XML External Entity (XXE) em Xmlsoft Libxml2

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.

CVE-2016-4658 Crítica · 9.8 CWE-119 25/09/2016

Nokogiri does not forbid namespace nodes in XPointer ranges

xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.

CVE-2016-5131 Alta · 8.8 CWE-416 23/07/2016

Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743...

Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function.

CVE-2016-1839 Média · 5.5 Exploit público CWE-125 20/05/2016

The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X...

The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.