Debian Libxml2 vulnerabilities

CVE-2017-9047 [HIGH] CVE-2017-9047: libxml2 - A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The fun... A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf

CVE-2022-49043 [HIGH] CVE-2022-49043: libxml2 - xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free. xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free. Scope: local bookworm: resolved (fixed in 2.9.14+dfsg-1.3~deb12u2) bullseye: resolved (fixed in 2.9.10+dfsg-6.7+deb11u6) forky: resolved (fixed in 2.12.7+dfsg+really2.9.14-0.4) sid: resolved (fixed in 2.12.7+dfsg+really2.9.14-0.4) trixie: resolved (fixed in 2.12.7+dfsg+really2.9.14-0.4)

CVE-2025-32415 [LOW] CVE-2025-32415: libxml2 - In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in... In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used. Scope: local bookworm: resolved (fixed in 2.9.14+dfsg-1.3~deb12u2) bullseye: resolved

CVE-2017-8872 [CRITICAL] CVE-2017-8872: libxml2 - The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attack... The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure. Scope: local bookworm: resolved (fixed in 2.9.4+dfsg1-6.1) bullseye: resolved (fixed in 2.9.4+dfsg1-6.1) forky: resolved (fixed in 2.9.4+dfsg1-6.1) sid: resolved (fixed in 2.9.4+dfsg1-6.1) trixie: resolved (

CVE-2017-9049 [HIGH] CVE-2017-9049: libxml2 - libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-re... libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398. Scope: local bookworm: resolved (fixed in 2.9.4+dfsg1-3.1) bullseye: resolved (fixe

CVE-2019-20388 [HIGH] CVE-2019-20388: libxml2 - xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStr... xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak. Scope: local bookworm: resolved (fixed in 2.9.10+dfsg-2.1) bullseye: resolved (fixed in 2.9.10+dfsg-2.1) forky: resolved (fixed in 2.9.10+dfsg-2.1) sid: resolved (fixed in 2.9.10+dfsg-2.1) trixie: resolved (fixed in 2.9.10+dfsg-2.1)

CVE-2022-2309 [HIGH] CVE-2022-2309: libxml2 - NULL Pointer Dereference allows attackers to cause a denial of service (or appli... NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwa

CVE-2013-0339 [MEDIUM] CVE-2013-0339: libxml2 - libxml2 through 2.9.1 does not properly handle external entities expansion unles... libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML Exter

CVE-2025-32414 [MEDIUM] CVE-2025-32414: libxml2 - In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access c... In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters. Scope: local bookworm: resolved (fixed in 2.9.14+dfsg-1.3~deb12u2) bullseye: resolved (fixe

CVE-2010-4494 [HIGH] CVE-2010-4494: libxml2 - Double free vulnerability in libxml2 2.7.8 and other versions, as used in Google... Double free vulnerability in libxml2 2.7.8 and other versions, as used in Google Chrome before 8.0.552.215 and other products, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling. Scope: local bookworm: resolved (fixed in 2.7.8.dfsg-2) bullseye: resolved (fixed in 2.7.8.dfsg-2) forky: res

CVE-2016-3627 [HIGH] CVE-2016-3627: libxml2 - The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when u... The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service (infinite recursion, stack consumption, and application crash) via a crafted XML document. Scope: local bookworm: resolved (fixed in 2.9.3+dfsg1-1.1) bullseye: resolved (fixed in 2.9.3+dfsg1-1.1) forky: r

CVE-2016-5131 [HIGH] CVE-2016-5131: libxml2 - Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome ... Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function. Scope: local bookworm: resolved (fixed in 2.9.4+dfsg1-2.1) bullseye: resolved (fixed in 2.9.4+dfsg1-2.1) forky: resolve

CVE-2019-19956 [HIGH] CVE-2019-19956: libxml2 - xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a me... xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs. Scope: local bookworm: resolved (fixed in 2.9.10+dfsg-2) bullseye: resolved (fixed in 2.9.10+dfsg-2) forky: resolved (fixed in 2.9.10+dfsg-2) sid: resolved (fixed in 2.9.10+dfsg-2) trixie: resolved (fixed in 2.9.10+dfsg-2)

CVE-2016-3705 [HIGH] CVE-2016-3705: libxml2 - The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser... The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a crafted XML document containing a large number of nested entity references. Scope: local bookworm: re

CVE-2012-5134 [MEDIUM] CVE-2012-5134: libxml2 - Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c ... Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 2.9.0 and earlier, as used in Google Chrome before 23.0.1271.91 and other products, allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted entities in an XML document. Scope: local bookworm: resolved (fixed in 2.8.0+dfsg1-7) bullsey

CVE-2025-27113 [LOW] CVE-2025-27113: libxml2 - libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference i... libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c. Scope: local bookworm: resolved (fixed in 2.9.14+dfsg-1.3~deb12u2) bullseye: resolved (fixed in 2.9.10+dfsg-6.7+deb11u6) forky: resolved (fixed in 2.12.7+dfsg+really2.9.14-0.4) sid: resolved (fixed in 2.12.7+dfsg+really2.9.14-0.4) trixie: resolved (fixed in 2.1

CVE-2016-4483 [HIGH] CVE-2016-4483: libxml2 - The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows contex... The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627. Scope: local bookworm: resolved (fixed in 2.9.3+dfsg1-1.1) bullseye: resolv

CVE-2011-3919 [HIGH] CVE-2011-3919: libxml2 - Heap-based buffer overflow in libxml2, as used in Google Chrome before 16.0.912.... Heap-based buffer overflow in libxml2, as used in Google Chrome before 16.0.912.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. Scope: local bookworm: resolved (fixed in 2.7.8.dfsg-7) bullseye: resolved (fixed in 2.7.8.dfsg-7) forky: resolved (fixed in 2.7.8.dfsg-7) sid: resolved (fixed in 2.7.8.d

CVE-2015-8806 [HIGH] CVE-2015-8806: libxml2 - dict.c in libxml2 allows remote attackers to cause a denial of service (heap-bas... dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the "<!DOCTYPE html" substring in a crafted HTML document. Scope: local bookworm: resolved (fixed in 2.9.3+dfsg1-1.1) bullseye: resolved (fixed in 2.9.3+dfsg1-1.1) forky: resolved (fixed in 2.9.3+dfsg1

CVE-2026-0990 [MEDIUM] CVE-2026-0990: libxml2 - A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion... A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call