All errata/sisyphus/ALT-PU-2015-2016-2
ALT-PU-2015-2016-2

Package update libxml2 in branch sisyphus

Version2.9.3-alt1
Task#153520
Published2026-02-04
Max severityCRITICAL
Severity:

Closed issues (24)

BDU:2015-12116
MEDIUM4.3

Уязвимость операционной системы Ubuntu, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2015-12-14Modified: 2024-11-28
CVSS 2.0MEDIUM 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:P
References
BDU:2016-00937
MEDIUM6.8

Уязвимость библиотеки libxml2, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2016-04-20Modified: 2024-11-28
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P
References
BDU:2016-01642
MEDIUM5.0

Уязвимость библиотеки libxml2, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2016-07-19Modified: 2024-11-28
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P
References
BDU:2016-01643
MEDIUM5.0

Уязвимость библиотеки libxml2, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2016-07-19Modified: 2024-11-28
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P
References
BDU:2016-01644
MEDIUM5.0

Уязвимость библиотеки libxml2, позволяющая нарушителю получить доступ к защищаемой информации из памяти процесса

Published: 2016-07-19Modified: 2024-11-28
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
References
BDU:2016-01645
MEDIUM5.0

Уязвимость библиотеки libxml2, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2016-07-19Modified: 2024-11-28
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P
References
BDU:2016-01646
MEDIUM6.4

Уязвимость библиотеки libxml2, позволяющая нарушителю вызвать отказ в обслуживании или получить конфиденциальную информацию

Published: 2016-07-19Modified: 2024-11-28
CVSS 2.0MEDIUM 6.4
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:P
References
BDU:2016-01647
MEDIUM5.8

Уязвимость библиотеки libxml2, позволяющая нарушителю вызвать отказ в обслуживании или получить конфиденциальную информацию

Published: 2016-07-19Modified: 2024-11-28
CVSS 2.0MEDIUM 5.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:P
References
BDU:2016-01648
MEDIUM5.0

Уязвимость библиотеки libxml2, позволяющая нарушителю получить конфиденциальную информацию

Published: 2016-07-19Modified: 2024-11-28
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
References
BDU:2016-01649
HIGH7.5

Уязвимость библиотеки libxml2, позволяющая нарушителю получить конфиденциальную информацию, вызвать отказ в обслуживании или оказать другое воздействие

Published: 2016-07-19Modified: 2021-03-23
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
References
CVE-2015-5312
HIGH7.1

The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660.

Published: 2015-12-15Modified: 2025-04-12
CVSS 2.0HIGH 7.1
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:C
References
CVE-2015-7497
MEDIUM5.0

Heap-based buffer overflow in the xmlDictComputeFastQKey function in dict.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors.

Published: 2015-12-15Modified: 2025-04-12
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P
References
CVE-2015-7498
MEDIUM5.0

Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors related to extracting errors after an encoding conversion failure.

Published: 2015-12-15Modified: 2025-04-12
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P
References
CVE-2015-7499
MEDIUM5.0

Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.

Published: 2015-12-15Modified: 2025-04-12
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
References
CVE-2015-7500
MEDIUM5.0

The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via unspecified vectors related to incorrect entities boundaries and start tags.

Published: 2015-12-15Modified: 2025-04-12
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P
References
CVE-2015-7941
MEDIUM4.3

libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities.

Published: 2015-11-18Modified: 2025-04-12
CVSS 2.0MEDIUM 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:P
References
CVE-2015-7942
MEDIUM6.8

The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941.

Published: 2015-11-18Modified: 2025-04-12
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P
References
CVE-2015-8241
MEDIUM6.4

The xmlNextChar function in libxml2 2.9.2 does not properly check the state, which allows context-dependent attackers to cause a denial of service (heap-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.

Published: 2015-12-15Modified: 2025-04-12
CVSS 2.0MEDIUM 6.4
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:P
References
CVE-2015-8242
MEDIUM5.8

The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (stack-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.

Published: 2015-12-15Modified: 2025-04-12
CVSS 2.0MEDIUM 5.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:P
References
CVE-2015-8317
MEDIUM5.0

The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an (1) unterminated encoding value or (2) incomplete XML declaration in XML data, which triggers an out-of-bounds heap read.

Published: 2015-12-15Modified: 2025-04-12
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
References
CVE-2015-8710
CRITICAL9.8

The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of-bounds heap memory access and application crash), or possibly have unspecified other impact via an unclosed HTML comment.

Published: 2016-04-11Modified: 2025-04-12
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
GHSA-jxjr-5h69-qw3w
NONE

Heap-based buffer overflow in nokogiri

Published: 2018-09-18Modified: 2023-07-05
References
GHSA-xjqg-9jvg-fgx2
NONE

Nokogiri subject to DoS via libxml2 vulnerability

Published: 2018-08-21Modified: 2023-03-14
References