Multiple denial of service vulnerabilities have been found in libxml2.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libxml2 | * | < 2.12.5 | >= 2.12.5 |
libxml2 is the XML C parser and toolkit developed for the GNOME project.
Multiple vulnerabilities have been discovered in libxml2. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All libxml2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.12.5"
If you cannot update to libxml2-2.12 yet you can update to the latest 2.11 version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.11.7 =dev-libs/libxml2-2.11*"
Multiple vulnerabilities have been found in libxml2, the worst of which could result in arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libxml2 | * | < 2.10.3 | >= 2.10.3 |
libxml2 is the XML C parser and toolkit developed for the GNOME project.
Multiple vulnerabilities have been discovered in libxml2. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All libxml2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.10.3"
Multiple vulnerabilities have been discovered in libxml2, the worst of which could result in arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libxml2 | * | < 2.10.2 | >= 2.10.2 |
libxml2 is the XML C parser and toolkit developed for the GNOME project.
Multiple vulnerabilities have been discovered in libxml2. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All libxml2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.10.2"
Multiple vulnerabilities have been found in libxml2, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libxml2 | * | < 2.9.11 | >= 2.9.11 |
libxml2 is the XML (eXtended Markup Language) C parser and toolkit initially developed for the GNOME project.
Multiple vulnerabilities have been discovered in libxml2. Please review the CVE identifiers referenced below for details.
A remote attacker could entice a user to process a specially crafted XML document using an application linked against libxml2, possibly resulting in a Denial of Service condition or obtaining sensitive information.
There is no known workaround at this time.
All libxml2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.9.12-r3"
Multiple vulnerabilities have been found in libxml2, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libxml2 | * | < 2.9.10 | >= 2.9.10 |
libxml2 is the XML (eXtended Markup Language) C parser and toolkit initially developed for the Gnome project.
Multiple vulnerabilities have been discovered in libxml2. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All libxml2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.9.10"
Multiple vulnerabilities have been found in libxml2, the worst of which could result in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libxml2 | * | < 2.9.4-r3 | >= 2.9.4-r3 |
libxml2 is the XML (eXtended Markup Language) C parser and toolkit initially developed for the Gnome project.
Multiple vulnerabilities have been discovered in libxml2. Please review the CVE identifiers referenced below for details.
A remote attacker, by enticing a user to process a specially crafted XML document, could remotely execute arbitrary code, conduct XML External Entity (XXE) attacks, or cause a Denial of Service condition.
There is no known workaround at this time.
All libxml2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.9.4-r3"
Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying some of these packages.
Multiple vulnerabilities have been found in libxml2, the worst of which could lead to the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libxml2 | * | < 2.9.4-r1 | >= 2.9.4-r1 |
libxml2 is the XML (eXtended Markup Language) C parser and toolkit initially developed for the Gnome project.
Multiple vulnerabilities have been discovered in libxml2. Please review the CVE identifiers referenced below for details.
A remote attacker could entice a user or automated system to process a specially crafted XML document, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All libxml2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.9.4-r1"
A vulnerability in libxml2 allows a remote attacker to cause Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libxml2 | * | < 2.9.2-r1 | >= 2.9.2-r1 |
libxml2 is the XML C parser and toolkit developed for the Gnome project.
libxml2 returns the empty string when the allocation limit is encountered while constructing the attribute value string.
A remote attacker may be able to cause Denial of Service via a specially crafted XML file.
There is no known workaround at this time.
All libxml2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.9.2-r1"
A vulnerability in libxml2 could result in Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libxml2 | * | < 2.9.2 | >= 2.9.2 |
libxml2 is the XML C parser and toolkit developed for the Gnome project.
parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled.
A context-dependent attacker could entice a user to a specially crafted XML file using an application linked against libxml2, possibly resulting in a Denial of Service condition.
There is no known workaround at this time.
All libxml2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.9.2"
Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying these packages.
A vulnerability in libxml2 allows a remote attacker to cause Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libxml2 | * | < 2.9.1-r4 | >= 2.9.1-r4 |
libxml2 is the XML C parser and toolkit developed for the Gnome project.
A vulnerability in the xmlParserHandlePEReference() function of parser.c, when expanding entity references, can be exploited to consume large amounts of memory and cause a crash or hang.
A remote attacker may be able to cause Denial of Service via a specially crafted XML file containing malicious attributes.
There is no known workaround at this time.
All libxml2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.9.1-r4"
Multiple vulnerabilities have been found in libxml2, allowing remote attackers to execute arbitrary code or cause Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libxml2 | * | < 2.9.1-r1 | >= 2.9.1-r1 |
libxml2 is the XML C parser and toolkit developed for the Gnome project.
Multiple vulnerabilities have been discovered in libxml2. Please review the CVE identifiers referenced below for details.
A remote attacker could entice a user to open a specially crafted document with an application linked against libxml2, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All libxml2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.9.1-r1"
A off-by-one error in libxml2 could result in execution of arbitrary code or Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libxml2 | * | < 2.8.0_rc1 | >= 2.8.0_rc1 |
libxml2 is the XML C parser and toolkit developed for the Gnome project.
The "xmlXPtrEvalXPtrPart()" function in xpointer.c contains an off-by-one error.
A remote attacker could entice a user or automated system to open a specially crafted XML document with an application using libxml2, possibly resulting in execution of arbitrary code or a Denial of Service condition.
There is no known workaround at this time.
All libxml2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.8.0_rc1"
A hash collision vulnerability in libxml2 allows remote attackers to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libxml2 | * | < 2.7.8-r5 | >= 2.7.8-r5 |
libxml2 is the XML C parser and toolkit developed for the Gnome project.
libxml2 does not properly randomize hash functions to protect against hash collision attacks.
A remote attacker could entice a user or automated system to open a specially crafted XML document with an application using libxml2 resulting in a Denial of Service condition.
There is no known workaround at this time.
All libxml2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.7.8-r5"
A boundary error in libxml2 could result in execution of arbitrary code or Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libxml2 | * | < 2.7.8-r4 | >= 2.7.8-r4 |
libxml2 is the XML C parser and toolkit developed for the Gnome project.
The "xmlStringLenDecodeEntities()" function in parser.c contains a boundary error which could possibly cause a heap-based buffer overflow.
A remote attacker could entice a user to open a specially crafted XML file in an application linked against libxml2, possibly resulting in the remote execution of arbitrary code with the permissions of the user running the application, or Denial of Service.
There is no known workaround at this time.
All libxml2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.7.8-r4"
Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying some of these packages.
Multiple vulnerabilities were found in libxml2 which could lead to execution of arbitrary code or a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libxml2 | * | < 2.7.8-r3 | >= 2.7.8-r3 |
libxml2 is the XML C parser and toolkit developed for the Gnome project.
Multiple vulnerabilities have been discovered in libxml2. Please review the CVE identifiers referenced below for details.
A local or remote attacker may be able to execute arbitrary code with the privileges of the application or cause a Denial of Service.
There is no known workaround at this time.
All libxml2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.7.8-r3"
Multiple Denial of Services vulnerabilities were found in libxml2.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libxml2 | * | < 2.7.3-r2 | >= 2.7.3-r2 |
libxml2 is a library to manipulate XML files.
The following vulnerabilities were reported after a test with the Codenomicon XML fuzzing framework:
A remote attacker could entice a user or automated system to open a specially crafted XML document with an application using libxml2 resulting in a Denial of Service condition.
There is no known workaround at this time.
All libxml2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.7.3-r2"
NOTE: This is a legacy GLSA. Updates for all affected architectures are available since August 30, 2009. It is likely that your system is already no longer affected by this issue.
Multiple vulnerabilities in libxml2 might lead to execution of arbitrary code or Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libxml2 | * | < 2.7.2-r1 | >= 2.7.2-r1 |
libxml2 is the XML (eXtended Markup Language) C parser and toolkit initially developed for the Gnome project.
Multiple vulnerabilities were reported in libxml2:
A remote attacker could entice a user or automated system to open a specially crafted XML document with an application using libxml2, possibly resulting in the exeution of arbitrary code or a high CPU and memory consumption.
There is no known workaround at this time.
All libxml2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.7.2-r1"
A Denial of Service vulnerability has been reported in libxml2.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libxml2 | * | < 2.6.30-r1 | >= 2.6.30-r1 |
libxml2 is the XML (eXtended Markup Language) C parser and toolkit initially developed for the Gnome project.
Brad Fitzpatrick reported that the xmlCurrentChar() function does not properly handle some UTF-8 multibyte encodings.
A remote attacker could entice a user to open a specially crafted XML document with an application using libxml2, possibly resulting in a high CPU consumption. Note that this vulnerability could also be triggered without user interaction by an automated system processing XML content.
There is no known workaround at this time.
All libxml2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.6.30-r1"
libxml2 contains multiple buffer overflows which could lead to the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libxml2 | * | < 2.6.15 | >= 2.6.15 |
libxml2 is an XML parsing library written in C.
Multiple buffer overflows have been detected in the nanoftp and nanohttp modules. These modules are responsible for parsing URLs with ftp information, and resolving names via DNS.
An attacker could exploit an application that uses libxml2 by forcing it to parse a specially-crafted XML file, potentially causing remote execution of arbitrary code.
There is no known workaround at this time.
All libxml2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.6.15"
A buffer overflow has been discovered in libxml2 versions prior to 2.6.6 which may be exploited by an attacker allowing the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/libxml2 | * | < 2.6.6 | >= 2.6.6 |
Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6. When the libxml2 library fetches a remote resource via FTP or HTTP, libxml2 uses parsing routines that can overflow a buffer caused by improper bounds checking if they are passed a URL longer than 4096 bytes.
If an attacker is able to exploit an application using libxml2 that parses remote resources, then this flaw could be used to execute arbitrary code.
No workaround is available; users are urged to upgrade libxml2 to 2.6.6.
All users are recommended to upgrade their libxml2 installation:
# emerge sync # emerge -pv ">=dev-libs/libxml2-2.6.6" # emerge ">=dev-libs/libxml2-2.6.6"