Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
57 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
xpointer.c in libxml2 before 2.9.5 (as used in nokogiri before 1.7.1 amongst other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.
Recommended action: Upgrade to 1.7.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 (as used in nokogiri before 1.6.7.1) does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660.
Recommended action: Upgrade to 1.6.7.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.
Recommended action: Upgrade to 1.6.6.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Nokogiri prior to 1.7.2, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
Recommended action: Upgrade to 1.7.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The xzhead function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
Recommended action: Upgrade to 1.8.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Loofah allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments. Users are affected if running Loofah < 2.2.1, but only: when running on MRI or RBX, in combination with libxml2 = 2.9.2. JRuby users are not affected.
Recommended action: Upgrade to 1.8.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839. GitHub is notifying on nokogiri as uses libxml2.
Recommended action: Upgrade to 1.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.