libxml2 vulnerabilities

A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.

A flaw was found in the libxml2 library where uncontrolled resource consumption occurs when processing XML catalogs with repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing redundant traversal of catalog chains.

An uncontrolled recursion vulnerability was found in libxml2's xmlCatalogXMLResolveURI function. It occurs when an XML catalog contains a delegate URI entry that references itself, leading to infinite recursion and call stack exhaustion.

A flaw was found in the RelaxNG parser of libxml2 related to handling external schema inclusions. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives, which can cause excessive recursion. Specially crafted schemas may lead to stack exhaustion and application crashes.

A vulnerability was found in libxml2 up to version 2.14.5, involving uncontrolled recursion in the xmlParseSGMLCatalog function of the xmlcatalog component. The attack requires local access and can be triggered with untrusted SGML catalogs.

A flaw in the interactive shell of the xmllint XML parsing tool causes overly long commands to not be properly size-checked, potentially leading to a crash. In rare configurations without modern protections, arbitrary code execution may be possible.

A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.

A flaw in libxml2's xmlBuildQName function causes integer overflows in buffer size calculations, leading to a stack-based buffer overflow. This can result in memory corruption or denial of service when processing crafted input.