CVE-2016-3705

libxml2: stack overflow before detecting invalid XML file

The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a crafted XML document containing a large number of nested entity references.

CVSS 3.0 · 7.5 High EPSS 5.1% KEV · Not listed

Vendors

Canonical Debian Hp and 3 more

Products

Ubuntu Linux Debian Linux Icewall Federation Agent and 5 more

CVE-2016-4447

libxml2: Heap-based buffer underreads due to xmlParseName

The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-based buffer underread and application crash) via a crafted file, involving xmlParseName.

CVSS 3.0 · 7.5 High EPSS 14.0% KEV · Not listed

Vendors

Apple Canonical Debian and 6 more

Products

Iphone Os Itunes Mac Os X and 11 more

CVE-2016-4448

libxml2: Format string vulnerability

Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.

CVSS 3.1 · 9.8 Critical EPSS 7.0% KEV · Not listed

Vendors

Apple Hp Mcafee and 6 more

Products

Icloud Iphone Os Itunes and 19 more

CVE-2016-4449

libxml2: Inappropriate fetch of entities content

XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.

CVSS 3.0 · 7.1 High EPSS 1.7% KEV · Not listed

Vendors

Canonical Debian Redhat and 1 more

Products

Ubuntu Linux Debian Linux Enterprise Linux and 2 more

CVE-2010-4008

libxml2: Crash (stack frame overflow or NULL pointer dereference) by traversal of XPath axis

libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service (application crash) via a crafted XML document.

CVSS 2.0 · 4.3 Medium EPSS 2.7% KEV · Not listed

Vendors

Apache Apple Canonical and 6 more

Products

Openoffice Iphone Os Itunes and 13 more

CVE-2012-5134

libxml2: Heap-buffer-underflow in xmlParseAttValueComplex

Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 2.9.0 and earlier, as used in Google Chrome before 23.0.1271.91 and other products, allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted entities in an XML document.

CVSS 2.0 · 6.8 Medium EPSS 4.4% KEV · Not listed

Vendors

Apple Google Redhat and 1 more

Products

Iphone Os Chrome Enterprise Linux and 1 more

CVE-2012-2871

libxslt: Heap-buffer overflow caused by bad cast in XSL transforms

libxml2 2.9.0-rc1 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly support a cast of an unspecified variable during handling of XSL transforms, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document, related to the _xmlNs data structure in include/libxml/tree.h.

CVSS 2.0 · 6.8 Medium EPSS 2.4% KEV · Not listed

Vendors

Apple Google Redhat and 1 more

Products

Iphone Os Chrome Enterprise Linux and 1 more

CVE-2012-0841

libxml2: hash table collisions CPU usage DoS

libxml2 before 2.8.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data.

CVSS 2.0 · 5.0 Medium EPSS 3.3% KEV · Not listed

Vendors

Apple Redhat Xmlsoft

Products

Iphone Os Enterprise Linux Libxml2

CVE-2011-1944

libxml2: Heap-based buffer overflow by adding new namespace node to an existing nodeset or merging nodesets

Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

CVSS 2.0 · 9.3 Critical EPSS 13.4% KEV · Not listed

Vendors

Redhat Xmlsoft

Products

Enterprise Linux Libxml Libxml2

CVE-2010-4494

libxml2: double-free in XPath processing code

Double free vulnerability in libxml2 2.7.8 and other versions, as used in Google Chrome before 8.0.552.215 and other products, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling.

CVSS 2.0 · 7.5 High EPSS 5.9% KEV · Not listed

Vendors

Apache Apple Debian and 7 more

Products

Openoffice Iphone Os Itunes and 15 more

CVE-2013-2877

libxml2: Out-of-bounds read via a document that ends abruptly

parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state.

CVSS 2.0 · 5.0 Medium EPSS 5.0% KEV · Not listed

Vendors

Google Redhat Xmlsoft

Products

Chrome Enterprise Linux Libxml2

CVE-2013-1969

libxml2: multiple use-after-free flaws

Multiple use-after-free vulnerabilities in libxml2 2.9.0 and possibly other versions might allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to the (1) htmlParseChunk and (2) xmldecl_done functions, as demonstrated by a buffer overflow in the xmlBufGetInputBase function.

CVSS 2.0 · 7.5 High EPSS 3.8% KEV · Not listed

Vendors

Xmlsoft

Products

Libxml2

CVE-2013-0339

libxml2: CPU consumption DoS and other effects when performing string substitutions during external entities expansion

libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because libxml2 already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed and each affected application would need its own CVE.

CVSS 2.0 · 6.8 Medium EPSS 3.6% KEV · Not listed

Vendors

Canonical Debian Suse and 1 more

Products

Ubuntu Linux Debian Linux Linux Enterprise Server and 1 more

CVE-2013-0338

libxml2: CPU consumption DoS when performing string substitutions during entities expansion

libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity.

CVSS 2.0 · 4.3 Medium EPSS 2.9% KEV · Not listed

Vendors

Canonical Opensuse Redhat and 1 more

Products

Ubuntu Linux Opensuse Enterprise Linux and 1 more

CVE-2018-9251

libxml2: infinite loop in xz_decomp function in xzlib.c

The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.

CVSS 3.0 · 5.3 Medium EPSS 2.4% KEV · Not listed

Vendors

Debian Redhat Xmlsoft

Products

Debian Linux Enterprise Linux Libxml2

CVE-2017-15412

libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate() function in xpath.c

Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 2.9% KEV · Not listed

Vendors

Debian Google Redhat and 1 more

Products

Debian Linux Chrome Ansible Tower and 7 more

CVE-2016-9598

libxml2: out-of-bounds read (unfixed CVE-2016-4483 in JBCS)

libxml2, as used in Red Hat JBoss Core Services, allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted XML document. NOTE: this vulnerability exists because of a missing fix for CVE-2016-4483.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed

Vendors

Redhat Xmlsoft

Products

Jboss Core Services Libxml2

CVE-2016-9597

libxml2: stack overflow before detecting invalid XML file (unfixed CVE-2016-3705 in JBCS)

It was found that Red Hat JBoss Core Services erratum RHSA-2016:2957 for CVE-2016-3705 did not actually include the fix for the issue found in libxml2, making it vulnerable to a Denial of Service attack due to a Stack Overflow. This is a regression CVE for the same issue as CVE-2016-3705.

CVSS 3.0 · 7.5 High EPSS 4.0% KEV · Not listed

Vendors

Canonical Debian Hp and 3 more

Products

Ubuntu Linux Debian Linux Icewall Federation Agent and 4 more

CVE-2016-9596

libxml2: stack exhaustion while parsing xml files in recovery mode (unfixed CVE-2016-3627 in JBCS)

libxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause a denial of service (stack consumption) via a crafted XML document. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-3627.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Redhat Xmlsoft

Products

Jboss Core Services Libxml2