Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 90

Export CSV
CVE-2016-1838

libxml2: Heap-based buffer overread in xmlPArserPrintFileContextInternal

The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.

CVSS 3.0 · 5.5 Medium EPSS 7.0% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Iphone Os Mac Os X Tvos and 13 more
CVE-2016-1839

libxml2: Heap-based buffer overread in xmlDictAddString

The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.

CVSS 3.0 · 5.5 Medium EPSS 7.3% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Iphone Os Mac Os X Tvos and 13 more
CVE-2016-1840

libxml2: Heap-buffer-overflow in xmlFAParserPosCharGroup

Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.

CVSS 3.0 · 7.8 High EPSS 3.2% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Iphone Os Mac Os X Tvos and 13 more
CVE-2016-3705

libxml2: stack overflow before detecting invalid XML file

The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a crafted XML document containing a large number of nested entity references.

CVSS 3.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Hp and 3 more
Products
Ubuntu Linux Debian Linux Icewall Federation Agent and 5 more
CVE-2016-4447

libxml2: Heap-based buffer underreads due to xmlParseName

The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-based buffer underread and application crash) via a crafted file, involving xmlParseName.

CVSS 3.0 · 7.5 High EPSS 14.0% KEV · Not listed
Vendors
Apple Canonical Debian and 6 more
Products
Iphone Os Itunes Mac Os X and 11 more
CVE-2016-4448

libxml2: Format string vulnerability

Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.

CVSS 3.1 · 9.8 Critical EPSS 7.0% KEV · Not listed
Vendors
Apple Hp Mcafee and 6 more
Products
Icloud Iphone Os Itunes and 19 more
CVE-2016-4449

libxml2: Inappropriate fetch of entities content

XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.

CVSS 3.0 · 7.1 High EPSS 1.7% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 2 more
CVE-2016-1833

libxml2: Heap-based buffer overread in htmlCurrentChar

The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.

CVSS 3.0 · 5.5 Medium EPSS 2.6% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Iphone Os Mac Os X Tvos and 13 more
CVE-2015-8710

libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of-bounds heap memory access and application crash), or possibly have unspecified other impact via an unclosed HTML comment.

CVSS 3.1 · 9.8 Critical EPSS 4.9% KEV · Not listed
Vendors
Debian Redhat Xmlsoft
Products
Debian Linux Enterprise Linux Jboss Enterprise Web Server and 1 more
CVE-2015-8317

libxml2: Out-of-bounds heap read when parsing file with unfinished xml declaration

The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an (1) unterminated encoding value or (2) incomplete XML declaration in XML data, which triggers an out-of-bounds heap read.

CVSS 2.0 · 5.0 Medium EPSS 5.9% KEV · Not listed
Vendors
Canonical Debian Hp and 2 more
Products
Ubuntu Linux Debian Linux Icewall Federation Agent and 8 more
CVE-2015-8242

libxml2: Buffer overread with HTML parser in push mode in xmlSAX2TextNode

The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (stack-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.

CVSS 2.0 · 5.8 Medium EPSS 4.3% KEV · Not listed
Vendors
Apple Canonical Hp and 2 more
Products
Iphone Os Mac Os X Tvos and 11 more
CVE-2015-8241

libxml2: Buffer overread with XML parser in xmlNextChar

The xmlNextChar function in libxml2 2.9.2 does not properly check the state, which allows context-dependent attackers to cause a denial of service (heap-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.

CVSS 2.0 · 6.4 Medium EPSS 5.4% KEV · Not listed
Vendors
Canonical Debian Hp and 2 more
Products
Ubuntu Linux Debian Linux Icewall Federation Agent and 8 more
CVE-2015-8035

libxml2: DoS caused by incorrect error detection during XZ decompression

The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.

CVSS 2.0 · 2.6 Low EPSS 3.3% KEV · Not listed
Vendors
Apple Canonical Debian and 2 more
Products
Iphone Os Mac Os X Tvos and 7 more
CVE-2015-7942

libxml2: heap-based buffer overflow in xmlParseConditionalSections()

The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941.

CVSS 2.0 · 6.8 Medium EPSS 4.5% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Iphone Os Mac Os X Tvos and 8 more
CVE-2015-7941

libxml2: Out-of-bounds memory access

libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities.

CVSS 2.0 · 4.3 Medium EPSS 3.1% KEV · Not listed
Vendors
Canonical Redhat Xmlsoft
Products
Ubuntu Linux Enterprise Linux Jboss Enterprise Web Server and 1 more
CVE-2015-7500

libxml2: Heap buffer overflow in xmlParseMisc

The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via unspecified vectors related to incorrect entities boundaries and start tags.

CVSS 2.0 · 5.0 Medium EPSS 5.9% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Iphone Os Mac Os X Tvos and 12 more
CVE-2015-7499

libxml2: Heap-based buffer overflow in xmlGROW

Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 6.4% KEV · Not listed
Vendors
Apple Canonical Debian and 4 more
Products
Iphone Os Mac Os X Tvos and 14 more
CVE-2011-1944

libxml2: Heap-based buffer overflow by adding new namespace node to an existing nodeset or merging nodesets

Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

CVSS 2.0 · 9.3 Critical EPSS 13.4% KEV · Not listed
Vendors
Redhat Xmlsoft
Products
Enterprise Linux Libxml Libxml2
CVE-2010-4494

libxml2: double-free in XPath processing code

Double free vulnerability in libxml2 2.7.8 and other versions, as used in Google Chrome before 8.0.552.215 and other products, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling.

CVSS 2.0 · 7.5 High EPSS 5.9% KEV · Not listed
Vendors
Apache Apple Debian and 7 more
Products
Openoffice Iphone Os Itunes and 15 more
CVE-2012-0841

libxml2: hash table collisions CPU usage DoS

libxml2 before 2.8.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data.

CVSS 2.0 · 5.0 Medium EPSS 3.3% KEV · Not listed
Vendors
Apple Redhat Xmlsoft
Products
Iphone Os Enterprise Linux Libxml2