Описание
Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions xmlXPathRunEval, xmlXPathCtxtCompile, and xmlXPathEvalExpr were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 2.14.5+dfsg-0.2 |
| esm-infra-legacy/trusty | released | 2.9.1+dfsg1-3ubuntu4.13+esm9 |
| esm-infra/bionic | released | 2.9.4+dfsg1-6.1ubuntu1.9+esm5 |
| esm-infra/focal | released | 2.9.10+dfsg-5ubuntu0.20.04.10+esm2 |
| esm-infra/xenial | released | 2.9.3+dfsg1-1ubuntu0.7+esm10 |
| jammy | released | 2.9.13+dfsg-1ubuntu0.9 |
| noble | released | 2.9.14+dfsg-1.3ubuntu3.5 |
| plucky | released | 2.12.7+dfsg+really2.9.14-0.4ubuntu0.3 |
| upstream | released | 2.14.5+dfsg-0.1 |
Показывать по
EPSS
6.2 Medium
CVSS3
Связанные уязвимости
A flaw was found in libxstl/libxml2. The 'exsltDynMapFunction' function in libexslt/dynamic.c does not contain a recursion depth check, which may cause an infinite loop via a specially crafted XSLT document while handling 'dyn:map()', leading to stack exhaustion and a local denial of service.
Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.
Uncontrolled recursion inXPath evaluationin libxml2 up to and includin ...
Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.
EPSS
6.2 Medium
CVSS3