Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 116

Export CSV
CVE-2017-8872

libxml2: Out-of-bounds read in htmlParseTryOrFinish

The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.

CVSS 3.1 · 9.1 Critical EPSS 2.3% KEV · Not listed
Vendors
Xmlsoft
Products
Libxml2
CVE-2016-1762

libxml2: Heap-based buffer-overread in xmlNextChar

The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.

CVSS 3.1 · 8.1 High EPSS 6.1% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Iphone Os Mac Os X Safari and 14 more
CVE-2016-1834

libxml2: Heap-buffer-overflow in xmlStrncat

Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.

CVSS 3.1 · 7.8 High EPSS 4.6% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Iphone Os Mac Os X Tvos and 13 more
CVE-2016-3627

libxml2: stack exhaustion while parsing xml files in recovery mode

The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service (infinite recursion, stack consumption, and application crash) via a crafted XML document.

CVSS 3.1 · 7.5 High EPSS 7.0% KEV · Not listed
Vendors
Canonical Debian Hp and 4 more
Products
Ubuntu Linux Debian Linux Icewall Federation Agent and 12 more
CVE-2017-5130

chromium-browser: heap overflow in libxml2

An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file.

CVSS 3.1 · 8.8 High EPSS 2.7% KEV · Not listed
Vendors
Debian Google Redhat and 1 more
Products
Debian Linux Chrome Rhel Extras and 1 more
CVE-2024-40896

libxml2: XXE vulnerability

In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.

CVSS 3.1 · 9.1 Critical EPSS 1.2% KEV · Not listed
Vendors
Netapp Redhat Xmlsoft
Products
H300s H300s Firmware H410c and 12 more
CVE-2022-2309

NULL Pointer Dereference in lxml/lxml

NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Fedoraproject Lxml Redhat and 1 more
Products
Fedora Lxml Enterprise Linux and 1 more
CVE-2025-27113

libxml2: NULL Pointer Dereference in libxml2 xmlPatMatch

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.

CVSS 3.1 · 2.9 Low EPSS 1.1% KEV · Not listed
Vendors
Xmlsoft
Products
Libxml2
CVE-2024-56171

libxml2: Use-After-Free in libxml2

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.

CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed
Vendors
Netapp Redhat Xmlsoft
Products
Active Iq Unified Manager H300s H300s Firmware and 25 more
CVE-2025-32415

libxml2: Out-of-bounds Read in xmlSchemaIDCFillNodeTables

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Xmlsoft
Products
Libxml2
CVE-2025-32414

libxml2: Out-of-Bounds Read in libxml2

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Xmlsoft
Products
Enterprise Linux Libxml2
CVE-2016-4483

libxml2: out-of-bounds read

The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627.

CVSS 3.1 · 7.5 High EPSS 6.0% KEV · Not listed
Vendors
Debian Oracle Redhat and 1 more
Products
Debian Linux Solaris Jboss Core Services and 1 more
CVE-2017-5969

libxml2: Null pointer dereference in xmlSaveDoc implementation

libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document. NOTE: The maintainer states "I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser.

CVSS 3.0 · 4.7 Medium EPSS 2.6% KEV · Not listed
Vendors
Xmlsoft
Products
Libxml2
CVE-2015-8241

libxml2: Buffer overread with XML parser in xmlNextChar

The xmlNextChar function in libxml2 2.9.2 does not properly check the state, which allows context-dependent attackers to cause a denial of service (heap-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.

CVSS 2.0 · 6.4 Medium EPSS 5.4% KEV · Not listed
Vendors
Canonical Debian Hp and 2 more
Products
Ubuntu Linux Debian Linux Icewall Federation Agent and 8 more
CVE-2016-4448

libxml2: Format string vulnerability

Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.

CVSS 3.1 · 9.8 Critical EPSS 7.0% KEV · Not listed
Vendors
Apple Hp Mcafee and 6 more
Products
Icloud Iphone Os Itunes and 19 more
CVE-2016-4449

libxml2: Inappropriate fetch of entities content

XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.

CVSS 3.0 · 7.1 High EPSS 1.7% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 2 more
CVE-2016-3705

libxml2: stack overflow before detecting invalid XML file

The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a crafted XML document containing a large number of nested entity references.

CVSS 3.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Hp and 3 more
Products
Ubuntu Linux Debian Linux Icewall Federation Agent and 5 more
CVE-2016-2073

libxml2: out-of-bounds read in htmlParseNameComplex()

The htmlParseNameComplex function in HTMLparser.c in libxml2 allows attackers to cause a denial of service (out-of-bounds read) via a crafted XML document.

CVSS 3.1 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Xmlsoft
Products
Ubuntu Linux Debian Linux Libxml2
CVE-2016-1840

libxml2: Heap-buffer-overflow in xmlFAParserPosCharGroup

Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.

CVSS 3.0 · 7.8 High EPSS 3.2% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Iphone Os Mac Os X Tvos and 13 more