xmlsoft Archives - CVE Vulnerability

CVE-2008-2935

Sun, 26 Feb 2023 09:09:46 +0000

Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction) functions in crypto.c in libexslt in libxslt 1.1.8 through 1.1.24 allow context-dependent attackers to execute arbitrary code via an XML file containing a long string as “an argument in the XSL input.”

The post CVE-2008-2935 appeared first on CVE Vulnerability.

CVE-2019-5815

Sun, 26 Feb 2023 06:33:46 +0000

Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data.

The post CVE-2019-5815 appeared first on CVE Vulnerability.

CVE-2019-18197

Sun, 26 Feb 2023 06:31:41 +0000

In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn’t reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed.

The post CVE-2019-18197 appeared first on CVE Vulnerability.

CVE-2019-13117

Sun, 26 Feb 2023 06:30:08 +0000

In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.

The post CVE-2019-13117 appeared first on CVE Vulnerability.

CVE-2019-13118

Sun, 26 Feb 2023 06:30:08 +0000

In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.

The post CVE-2019-13118 appeared first on CVE Vulnerability.

CVE-2019-11068

Sun, 26 Feb 2023 06:29:24 +0000

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.

The post CVE-2019-11068 appeared first on CVE Vulnerability.

CVE-2021-30560

Thu, 23 Feb 2023 14:09:18 +0000

Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

The post CVE-2021-30560 appeared first on CVE Vulnerability.

CVE-2022-29824

godfreyd94 — Thu, 23 Feb 2023 05:18:31 +0000

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don’t check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2’s buffer functions, for example libxslt through 1.1.35, is affected as well.

The post CVE-2022-29824 appeared first on CVE Vulnerability.