Most recent entries from all

ALSA-2022:0899 — Moderate: libxml2 security update

Affected: AlmaLinux:8: libxml2-devel

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

* libxml2: Use-after-free of ID and IDREF attributes (CVE-2022-23308)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2022-01453

Withdrawn: BELL-CVE-2022-23308 — CVE-2022-23308 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2022-avi-1019 — De multiples vulnérabilités ont été découvertes dans Nessus. Elles permettent à un attaquant de provoquer un problème d…

certfr-2022-avi-1019

cnvd-2022-21487

EUVD-2026-237373

fkie_cve-2022-23308

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

GHSA-8v47-xfh7-92fh

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

gsd-2022-23308

ICSA-23-075-01 — Siemens SCALANCE, RUGGEDCOM Third-Party

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1071, CVE-2019-1073. A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine. A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of service (DOS) due to a deadlock problem. LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs. A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given. An out-of-bounds hea…

msrc_CVE-2022-23308 — valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

msrc_CVE-2022-23308

OESA-2022-1582 — libxml2 security update

Affected: openEuler:20.03-LTS-SP1: libxml2, openEuler:20.03-LTS-SP2: libxml2, openEuler:20.03-LTS-SP3: libxml2

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library. Security Fix(es): xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.(CVE-2019-19956) valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.(CVE-2022-23308)

openSUSE-SU-2022:0802-1 — Security update for python-libxml2-python

Security update for python-libxml2-python

RHSA-2022:1389 — Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP11 security update

libxml2: Use-after-free in xmlEncodeEntitiesInternal() in entities.c libxml2: Heap-based buffer overflow in xmlEncodeEntitiesInternal() in entities.c libxml2: Use-after-free in xmlXIncludeDoProcess() in xinclude.c libxml2: NULL pointer dereference when post-validating mixed content parsed in recovery mode libxml2: Exponential entity expansion attack bypasses all existing protection mechanisms openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates httpd: Errors encountered during the discarding of request body lead to HTTP request smuggling libxml2: Use-after-free of ID and IDREF attributes

SUSE-SU-2022:0802-1 — Security update for python-libxml2-python

Security update for python-libxml2-python

UBUNTU-CVE-2022-23308

Affected: Ubuntu:Pro:14.04:LTS: libxml2, Ubuntu:Pro:16.04:LTS: libxml2, Ubuntu:18.04:LTS: libxml2, Ubuntu:20.04:LTS: libxml2

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

VDE-2022-046 — PHOENIX CONTACT: Multiple Linux component vulnerabilities in PLCnext Firmware

UPDATE A: Two devices (ENERGY AXC PU, SMARTRTU AXC SG) added (24.11.2022) Update for PLCnext Firmware containing fixes for recent vulnerability findings in Linux components and security enhancements. PLCnext Control AXC F x152 is certified according to IEC 62443-4-1 and IEC 62443-4-2. This certification requires that all third-party components used in the firmware are regularly checked for known vulnerabilities.

WID-SEC-W-2022-0602 — IBM Security Verify Access: Mehrere Schwachstellen

Ein entfernter anonymer, authentisierter oder lokaler Angreifer oder ein Angreifer aus dem angrenzenden Netzwerk kann mehrere Schwachstellen in IBM Security Verify Access ausnutzen, um einen Cross-Site-Scripting-Angriff durchzuführen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern, Informationen zu manipulieren, einen Denial-of-Service-Zustand zu verursachen und Sicherheitsmaßnahmen zu umgehen.