Описание
In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | released | 2.9.4+dfsg1-6.1ubuntu1.6 |
| devel | not-affected | 2.9.14+dfsg-1 |
| esm-infra-legacy/trusty | not-affected | 2.9.1+dfsg1-3ubuntu4.13+esm3 |
| esm-infra/bionic | not-affected | 2.9.4+dfsg1-6.1ubuntu1.6 |
| esm-infra/focal | not-affected | 2.9.10+dfsg-5ubuntu0.20.04.3 |
| esm-infra/xenial | released | 2.9.3+dfsg1-1ubuntu0.7+esm2 |
| focal | released | 2.9.10+dfsg-5ubuntu0.20.04.3 |
| impish | released | 2.9.12+dfsg-4ubuntu0.2 |
| jammy | released | 2.9.13+dfsg-1ubuntu0.1 |
| trusty/esm | released | 2.9.1+dfsg1-3ubuntu4.13+esm3 |
Показывать по
Ссылки на источники
EPSS
4.3 Medium
CVSS2
6.5 Medium
CVSS3
Связанные уязвимости
In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.
In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.
In libxml2 before 2.9.14, several buffer handling functions in buf.c ( ...
In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.
EPSS
4.3 Medium
CVSS2
6.5 Medium
CVSS3