ALAS2023-2023-096 --- libxml2ID: oval:org.secpod.oval:def:19500083 | Date: (C)2023-06-12 (M)2023-12-07 |
Class: PATCH | Family: unix |
valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. A flaw was found in the libxml2 library in functions used to manipulate the xmlBuf and the xmlBuffer types. A substantial input causes values to calculate buffer sizes to overflow, resulting in an out-of-bounds write. An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault. An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked
Platform: |
Amazon Linux 2023 |
Product: |
libxml2 |
python3-libxml2 |