/
CVE-2015-1819.yml
53 lines (47 loc) · 2.04 KB
/
CVE-2015-1819.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
---
gem: nokogiri
cve: 2015-1819
ghsa: q7wx-62r7-j2x7
url: https://github.com/sparklemotion/nokogiri/issues/1374
title: Nokogiri gem contains several vulnerabilities in libxml2 and libxslt
date: 2015-04-14
description: |
Several vulnerabilities were discovered in the libxml2 and libxslt libraries
that the Nokogiri gem depends on.
CVE-2015-1819
A denial of service flaw was found in the way libxml2 parsed XML
documents. This flaw could cause an application that uses libxml2 to use an
excessive amount of memory.
CVE-2015-7941
libxml2 does not properly stop parsing invalid input, which allows
context-dependent attackers to cause a denial of service (out-of-bounds read
and libxml2 crash) via crafted specially XML data.
CVE-2015-7942
The xmlParseConditionalSections function in parser.c in libxml2
does not properly skip intermediary entities when it stops parsing invalid
input, which allows context-dependent attackers to cause a denial of service
(out-of-bounds read and crash) via crafted XML data.
CVE-2015-7995
The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not
check whether the parent node is an element, which allows attackers to cause
a denial of service using a specially crafted XML document.
CVE-2015-8035
The xz_decomp function in xzlib.c in libxml2 2.9.1 does not
properly detect compression errors, which allows context-dependent attackers
to cause a denial of service (process hang) via crafted XML data.
Another vulnerability was discoverd in libxml2 that could cause parsing
of unclosed comments to result in "conditional jump or move depends on
uninitialized value(s)" and unsafe memory access. This issue does not have a
CVE assigned yet. See related URLs for details. Patched in v1.6.7.rc4.
patched_versions:
- "~> 1.6.6.4"
- ">= 1.6.7.rc4"
related:
cve:
- 2015-7941
- 2015-7942
- 2015-7995
- 2015-8035
url:
- https://github.com/sparklemotion/nokogiri/pull/1376
- https://github.com/sparklemotion/nokogiri/commit/8f3de6d88d0da11fb62a45daa61b85ce71b4af59