opensuse/python-libxml2&distro=openSUSE Tumbleweed

Vulnerabilities (16)

• CVE-2016-4483HigApr 11, 2017
  affected < 2.9.4-1.4fixed 2.9.4-1.4

  The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization. NOTE: this vulnerability may be a duplicate of

• CVE-2016-1840HigMay 20, 2016
  affected < 2.9.4-1.4fixed 2.9.4-1.4

  Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory c

• CVE-2016-1839MedMay 20, 2016
  affected < 2.9.4-1.4fixed 2.9.4-1.4

  The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.

• CVE-2016-1838MedMay 20, 2016
  affected < 2.9.4-1.4fixed 2.9.4-1.4

  The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML docume

• CVE-2016-1837MedMay 20, 2016
  affected < 2.9.4-1.4fixed 2.9.4-1.4

  Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allow remote attackers to cause a denial

• CVE-2016-1836MedMay 20, 2016
  affected < 2.9.4-1.4fixed 2.9.4-1.4

  Use-after-free vulnerability in the xmlDictComputeFastKey function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service via a crafted XML document.

• CVE-2016-1835HigMay 20, 2016
  affected < 2.9.4-1.4fixed 2.9.4-1.4

  Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a crafted XML document.

• CVE-2016-1834HigMay 20, 2016
  affected < 2.9.4-1.4fixed 2.9.4-1.4

  Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v

• CVE-2016-1833MedMay 20, 2016
  affected < 2.9.4-1.4fixed 2.9.4-1.4

  The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.

• CVE-2016-3705HigMay 17, 2016
  affected < 2.9.4-1.4fixed 2.9.4-1.4

  The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a crafted XML

• CVE-2016-3627HigMay 17, 2016
  affected < 2.9.4-1.4fixed 2.9.4-1.4

  The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service (infinite recursion, stack consumption, and application crash) via a crafted XML document.

• CVE-2016-1762HigMar 24, 2016
  affected < 2.9.4-1.4fixed 2.9.4-1.4

  The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.

• CVE-2012-5134Nov 28, 2012
  affected < 2.9.4-1.4fixed 2.9.4-1.4

  Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 2.9.0 and earlier, as used in Google Chrome before 23.0.1271.91 and other products, allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted entit

• CVE-2008-4226Nov 25, 2008
  affected < 2.9.4-1.4fixed 2.9.4-1.4

  Integer overflow in the xmlSAX2Characters function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a large XML document.

• CVE-2008-4225Nov 25, 2008
  affected < 2.9.4-1.4fixed 2.9.4-1.4

  Integer overflow in the xmlBufferResize function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (infinite loop) via a large XML document.

• CVE-2008-4409Oct 3, 2008
  affected < 2.9.4-1.4fixed 2.9.4-1.4

  libxml2 2.7.0 and 2.7.1 does not properly handle "predefined entities definitions" in entities, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash), as demonstrated by use of xmllint on a certain XML document, a differe