Withdrawn by the publisher.

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.

expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE. shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename. In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start o…

expat: Out-of-bounds heap read on crafted input causing crash httpd: CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir libxml2: Use after free triggered by XPointer paths beginning with range-to curl: escape and unescape integer overflows curl: Cookie injection for other servers curl: Case insensitive password comparison curl: Out-of-bounds write via unchecked multiplication curl: Double-free in curl_maprintf curl: Double-free in krb5 code curl: curl_getdate out-of-bounds read curl: URL unescape heap overflow via integer truncation curl: Use-after-free via shared cookies curl: Invalid URL parsing with '#' curl: IDNA 2003 makes curl use wrong host libxml2: XML External Entity vulnerability libxml2: stack exhaustion while parsing xml files in recovery mode (unfixed CVE-2016-3627 in JBCS) libxml2: stack overflow before detecting invalid XML file (unfixed CVE-2016-3705 in JBCS) libxml2: out-of-bounds read (unfixed CVE-2016-4483 in JBCS) pcre: Out-of-bounds read in compile_bracket_matchingpath function (8.41/3) pcre: Invalid Unicode property lookup (8.41/7, 10.24/2) pcre: invalid memory read in _pcre32_xclass (pcre_xclass.c) pcre: stack-based buffer overflow write in pcre32_copy_substring pcre: stack-based buffer overflow write in pcre32_copy_substring libxml2: Buffer overflow in function xmlSnprintfElementContent libxml2: Stack-based buffer overflow in function xmlSnprintfElementContent libxml2: Heap-based buffer over-read in function xmlDic…

Security update for libxml2

Affected: Ubuntu:14.04:LTS: libxml2, Ubuntu:16.04:LTS: libxml2, Ubuntu:18.04:LTS: libxml2

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in libxml2 ausnutzen, um Informationen offenzulegen.