FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  456232
Date:      2017-12-13
Time:      20:45:21Z
Committer: madpilot

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

I found 2 entries for ce4b3af8-0b7c-11e1-846b-00235409fd3e. There should be only one.
VuXML IDDescription
843a4641-9816-11e2-9c51-080027019be0libxml2 -- cpu consumption Dos

Kurt Seifried reports:

libxml2 is affected by the expansion of internal entities (which can be used to consume resources) and external entities (which can cause a denial of service against other services, be used to port scan, etc.)..


Discovery 2013-02-21
Entry 2013-03-29
libxml2
lt 2.8.0

CVE-2013-0338
CVE-2013-0339
http://seclists.org/oss-sec/2013/q1/391
https://security-tracker.debian.org/tracker/CVE-2013-0338
https://security-tracker.debian.org/tracker/CVE-2013-0339
0642b064-56c4-11e4-8b87-bcaec565249clibxml2 -- Denial of service

RedHat reports:

A denial of service flaw was found in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, would lead to excessive CPU consumption (denial of service) based on excessive entity substitutions, even if entity substitution was disabled, which is the parser default behavior.


Discovery 2014-10-16
Entry 2014-10-18
Modified 2015-07-15
libxml2
lt 2.9.2

linux-c6-libxml2
lt 2.7.6_2

linux-f10-libxml2
ge *

CVE-2014-3660
https://rhn.redhat.com/errata/RHSA-2014-1655.html
e7bb3885-da40-11e3-9ecb-2c4138874f7dlibxml2 -- lack of end-of-document check DoS

CVE MITRE reports:

parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state.


Discovery 2013-04-11
Entry 2013-07-10
Modified 2015-07-15
libxml2
lt 2.9.1

linux-c6-libxml2
lt 2.7.6_2

linux-f10-libxml2
ge *

CVE-2013-2877
https://git.gnome.org/browse/libxml2/tag/?id=CVE-2013-2877
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2877
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2877
b8ae4659-a0da-11e1-a294-bcaec565249clibxml2 -- An off-by-one out-of-bounds write by XPointer

Google chrome team reports:

An off-by-one out-of-bounds write flaw was found in the way libxml, a library for providing XML and HTML support, evaluated certain XPointer parts (XPointer is used by libxml to include only the part from the returned XML document, that can be accessed using the XPath expression given with the XPointer). A remote attacker could provide a specially-crafted XML file, which once opened in an application, linked against libxml, would lead to that application crash, or, potentially arbitrary code execution with the privileges of the user running the application.

Note: The flaw to be exploited requires the particular application, linked against libxml, to use the XPointer evaluation functionality.


Discovery 2012-05-15
Entry 2012-05-18
Modified 2014-04-30
libxml2
lt 2.7.8_3

linux-f10-libxml2
lt 2.7.8_3

CVE-2011-3202
http://googlechromereleases.blogspot.com/2012/05/stable-channel-update.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3102
57f1a624-6197-11e1-b98c-bcaec565249clibxml2 -- heap buffer overflow

Google chrome team reports:

Heap-based buffer overflow in libxml2, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


Discovery 2012-01-05
Entry 2012-02-27
libxml2
linux-f10-libxml2
lt 2.7.8_2

CVE-2011-3919
http://googlechromereleases.blogspot.com/2012/01/stable-channel-update.html
e195679d-045b-4953-bb33-be0073ba2ac6libxml2 -- multiple vulnerabilities

Daniel Veillard reports:

More format string warnings with possible format string vulnerability (David Kilzer)

Avoid building recursive entities (Daniel Veillard)

Heap-based buffer overread in htmlCurrentChar (Pranjal Jumde)

Heap-based buffer-underreads due to xmlParseName (David Kilzer)

Heap use-after-free in xmlSAX2AttributeNs (Pranjal Jumde)

Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral (Pranjal Jumde)

Fix some format string warnings with possible format string vulnerability (David Kilzer)

Detect change of encoding when parsing HTML names (Hugh Davenport)

Fix inappropriate fetch of entities content (Daniel Veillard)

Bug 759398: Heap use-after-free in xmlDictComputeFastKey (Pranjal Jumde)

Bug 758605: Heap-based buffer overread in xmlDictAddString (Pranjal Jumde)

Bug 758588: Heap-based buffer overread in xmlParserPrintFileContextInternal (David Kilzer)

Bug 757711: heap-buffer-overflow in xmlFAParsePosCharGroup (Pranjal Jumde)

Add missing increments of recursion depth counter to XML parser. (Peter Simons)

Fix NULL pointer deref in XPointer range-to


Discovery 2016-05-23
Entry 2016-08-28
libxml2
lt 2.9.4

https://mail.gnome.org/archives/xml/2016-May/msg00023.html
https://bugzilla.gnome.org/show_bug.cgi?id=759398
https://bugzilla.gnome.org/show_bug.cgi?id=758605
https://bugzilla.gnome.org/show_bug.cgi?id=758588
https://bugzilla.gnome.org/show_bug.cgi?id=757711
https://git.gnome.org/browse/libxml2/patch/?id=d8083bf77955b7879c1290f0c0a24ab8cc70f7fb
CVE-2016-1762
CVE-2016-1833
CVE-2016-1834
CVE-2016-1835
CVE-2016-1836
CVE-2016-1837
CVE-2016-1838
CVE-2016-1839
CVE-2016-1840
CVE-2016-3627
CVE-2016-3705
CVE-2016-4449
CVE-2016-4483
efdd0edc-da3d-11e3-9ecb-2c4138874f7dlibxml2 -- entity substitution DoS

Stefan Cornelius reports:

It was discovered that libxml2, a library providing support to read, modify and write XML files, incorrectly performs entity substitution in the doctype prolog, even if the application using libxml2 disabled any entity substitution. A remote attacker could provide a specially-crafted XML file that, when processed, would lead to the exhaustion of CPU and memory resources or file descriptors.

This issue was discovered by Daniel Berrange of Red Hat.


Discovery 2013-12-03
Entry 2014-05-06
Modified 2015-07-15
libxml2
lt 2.9.1

linux-c6-libxml2
lt 2.7.6_2

linux-f10-libxml2
ge *

CVE-2014-0191
http://www.openwall.com/lists/oss-security/2014/05/06/4
https://git.gnome.org/browse/libxml2/tag/?id=CVE-2014-0191
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0191