FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

libxml2 -- multiple vulnerabilities

Affected packages
libxml2 < 2.9.4

Details

VuXML ID e195679d-045b-4953-bb33-be0073ba2ac6
Discovery 2016-05-23
Entry 2016-08-28

Daniel Veillard reports:

More format string warnings with possible format string vulnerability (David Kilzer)

Avoid building recursive entities (Daniel Veillard)

Heap-based buffer overread in htmlCurrentChar (Pranjal Jumde)

Heap-based buffer-underreads due to xmlParseName (David Kilzer)

Heap use-after-free in xmlSAX2AttributeNs (Pranjal Jumde)

Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral (Pranjal Jumde)

Fix some format string warnings with possible format string vulnerability (David Kilzer)

Detect change of encoding when parsing HTML names (Hugh Davenport)

Fix inappropriate fetch of entities content (Daniel Veillard)

Bug 759398: Heap use-after-free in xmlDictComputeFastKey (Pranjal Jumde)

Bug 758605: Heap-based buffer overread in xmlDictAddString (Pranjal Jumde)

Bug 758588: Heap-based buffer overread in xmlParserPrintFileContextInternal (David Kilzer)

Bug 757711: heap-buffer-overflow in xmlFAParsePosCharGroup (Pranjal Jumde)

Add missing increments of recursion depth counter to XML parser. (Peter Simons)

Fix NULL pointer deref in XPointer range-to

References

CVE Name CVE-2016-1762
CVE Name CVE-2016-1833
CVE Name CVE-2016-1834
CVE Name CVE-2016-1835
CVE Name CVE-2016-1836
CVE Name CVE-2016-1837
CVE Name CVE-2016-1838
CVE Name CVE-2016-1839
CVE Name CVE-2016-1840
CVE Name CVE-2016-3627
CVE Name CVE-2016-3705
CVE Name CVE-2016-4449
CVE Name CVE-2016-4483
URL https://bugzilla.gnome.org/show_bug.cgi?id=757711
URL https://bugzilla.gnome.org/show_bug.cgi?id=758588
URL https://bugzilla.gnome.org/show_bug.cgi?id=758605
URL https://bugzilla.gnome.org/show_bug.cgi?id=759398
URL https://git.gnome.org/browse/libxml2/patch/?id=d8083bf77955b7879c1290f0c0a24ab8cc70f7fb
URL https://mail.gnome.org/archives/xml/2016-May/msg00023.html