This could lead to crashes and/or denial of service if a large number of entities were being parsed or if an attacker could supply an entity stream with entities that would trigger the vulnerability.
Thanks to Daniel Gaffney of the Google Security Team for discovering this issue. libexpat version 2.4.9 has been released, with the following change: A new version of libxml2 has been released with this fix, version 2.9.32.
libxml2 version 2.9.32, with the above fix, has been released. libexpat version 2.4.9 has been released, with the following change: A new version of libxml2 has been released with this fix, version 2.9.32. libxml2 version 2.9.32, with the above fix, has been released.
Affected software: libexpat through 2.4.9 with the above change libexpat through 2.4.9 has been released, with the following change: A new version of libxml2 has been released with this fix, version 2.9.32. libxml2 version 2.9.32, with the above fix, has been released. libexpat version 2.4.9 has been released, with the following change: A new version of libxml2 has been released with this fix, version 2.9.32. libxml2 version 2.9.32, with
CVE-2021-43670
This vulnerability allows remote attackers to cause a denial-of-service via a crafted entity.
Thanks to Daniel Gaffney of the Google Security Team for discovering this issue. libexpat version 2.4.9 has been released, with the following change: A new version of libxml2 has been released with this fix, version 2.9.32.
What is libxml2 and how is it used?
Libxml2 is a library of C routines that parse and process XML documents in various ways. It provides a programming interface to the libxml2 library, which handles most of the work in parsing and building XML documents. Its use is widespread across many projects, including web browsers, email clients, desktop applications, and more.
What is libxml2? libxml2 is a library for processing XML files. libxml2 parses and validates documents, builds DOM trees, optimizes XML and HTML output, manages entity references, and provides various other functionality related to parsing and transforming XML.
libexpat version 2.4.9 has been released, with the following change: A new version of libxml2 has been released with this fix, version 2.9.32. libxml2 version 2.9.32, with the above fix, has been released.
Timeline
Published on: 10/24/2022 14:15:00 UTC
Last modified on: 10/24/2022 16:20:00 UTC