The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Debian:12 libxml2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1.1"}]}]

Debian:13 libxml2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1.1"}]}]

Debian:14 libxml2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1.1"}]}]

参照URL

advisory security-tracker.debian.org