Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

libxml2-2-2.9.4-1.22 on GA media

libxml2: Crash (stack frame overflow or NULL pointer dereference) by traversal of XPath axis libxml2: double-free in XPath processing code libxml2: Off-by-one error leading to heap-based buffer overflow in encoding libxml2: Heap-based buffer overflow by adding new namespace node to an existing nodeset or merging nodesets libxml2: double free caused by malformed XPath expression in XSLT libxml2: double-free caused by malformed XPath expression in XSLT

Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Tenable Security Nessus Network Monitor ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen und Daten zu manipulieren.