Debian Mxml vulnerabilities

CVE-2018-20004 [HIGH] CVE-2018-20004: mxml - An issue has been found in Mini-XML (aka mxml) 2.12. It is a stack-based buffer ... An issue has been found in Mini-XML (aka mxml) 2.12. It is a stack-based buffer overflow in mxml_write_node in mxml-file.c via vectors involving a double-precision floating point number and the '' substring, as demonstrated by testmxml. Scope: local bookworm: resolved (fixed in 2.12-2) bullseye: resolved (fixed in 2.12-2) forky: resolved (fixed in 2.12-2) sid: resolved

CVE-2018-20593 [MEDIUM] CVE-2018-20593: mxml - In Mini-XML (aka mxml) v2.12, there is stack-based buffer overflow in the scan_f... In Mini-XML (aka mxml) v2.12, there is stack-based buffer overflow in the scan_file function in mxmldoc.c. Scope: local bookworm: resolved (fixed in 3.0-1) bullseye: resolved (fixed in 3.0-1) forky: resolved (fixed in 3.0-1) sid: resolved (fixed in 3.0-1) trixie: resolved (fixed in 3.0-1)

CVE-2016-4570 [MEDIUM] CVE-2016-4570: mxml - The mxmlDelete function in mxml-node.c in mxml 2.9, 2.7, and possibly earlier al... The mxmlDelete function in mxml-node.c in mxml 2.9, 2.7, and possibly earlier allows remote attackers to cause a denial of service (stack consumption) via crafted xml file. Scope: local bookworm: resolved (fixed in 2.9-1) bullseye: resolved (fixed in 2.9-1) forky: resolved (fixed in 2.9-1) sid: resolved (fixed in 2.9-1) trixie: resolved (fixed in 2.9-1)

CVE-2018-20592 [MEDIUM] CVE-2018-20592: mxml - In Mini-XML (aka mxml) v2.12, there is a use-after-free in the mxmlAdd function ... In Mini-XML (aka mxml) v2.12, there is a use-after-free in the mxmlAdd function of the mxml-node.c file. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted xml file, as demonstrated by mxmldoc. Scope: local bookworm: resolved (fixed in 3.0-1) bullseye: resolved (fixed in 3.0-1) forky: resolved (fixed in 3.0-1) sid: resolved

CVE-2016-4571 [MEDIUM] CVE-2016-4571: mxml - The mxml_write_node function in mxml-file.c in mxml 2.9, 2.7, and possibly earli... The mxml_write_node function in mxml-file.c in mxml 2.9, 2.7, and possibly earlier allows remote attackers to cause a denial of service (stack consumption) via crafted xml file. Scope: local bookworm: resolved (fixed in 2.9-2) bullseye: resolved (fixed in 2.9-2) forky: resolved (fixed in 2.9-2) sid: resolved (fixed in 2.9-2) trixie: resolved (fixed in 2.9-2)

CVE-2026-5037 [MEDIUM] CVE-2026-5037: mxml - A vulnerability was determined in mxml up to 4.0.4. This issue affects the funct... A vulnerability was determined in mxml up to 4.0.4. This issue affects the function index_sort of the file mxml-index.c of the component mxmlIndexNew. Executing a manipulation of the argument tempr can lead to stack-based buffer overflow. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called 6e273