VulnerableCode Package Details - pkg:nuget/libxml2@2.9.8

Search for packages

Vulnerability	Summary	Fixed by
VCID-5452-mez7-1uf3 Aliases: CVE-2018-9251	The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.	There are no reported fixed by versions.
VCID-bpwu-gpw3-qkcp Aliases: CVE-2018-14404 GHSA-6qvp-r6r3-9p7h	Nokogiri gem, via libxml2, is affected by multiple vulnerabilities Nokogiri 1.8.5 has been released. This is a security and bugfix release. It addresses two CVEs in upstream libxml2 rated as "medium" by Red Hat, for which details are below. If you're using your distro's system libraries, rather than Nokogiri's vendored libraries, there's no security need to upgrade at this time, though you may want to check with your distro whether they've patched this (Canonical has patched Ubuntu packages). Note that these patches are not yet (as of 2018-10-04) in an upstream release of libxml2. Full details about the security update are available in Github Issue #1785. [#1785]: https://github.com/sparklemotion/nokogiri/issues/1785 ----- [MRI] Pulled in upstream patches from libxml2 that address CVE-2018-14404 and CVE-2018-14567. Full details are available in #1785. Note that these patches are not yet (as of 2018-10-04) in an upstream release of libxml2. ----- CVE-2018-14404 Permalink: https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14404.html Description: A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application Canonical rates this vulnerability as "Priority: Medium" ----- CVE-2018-14567 Permalink: https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14567.html Description: infinite loop in LZMA decompression Canonical rates this vulnerability as "Priority: Medium"	There are no reported fixed by versions.
VCID-kt4k-xgcs-zkge Aliases: CVE-2018-14567	libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-5452-mez7-1uf3
Aliases:
CVE-2018-9251

The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.

There are no reported fixed by versions.

VCID-bpwu-gpw3-qkcp
Aliases:
CVE-2018-14404
GHSA-6qvp-r6r3-9p7h

Nokogiri gem, via libxml2, is affected by multiple vulnerabilities Nokogiri 1.8.5 has been released. This is a security and bugfix release. It addresses two CVEs in upstream libxml2 rated as "medium" by Red Hat, for which details are below. If you're using your distro's system libraries, rather than Nokogiri's vendored libraries, there's no security need to upgrade at this time, though you may want to check with your distro whether they've patched this (Canonical has patched Ubuntu packages). Note that these patches are not yet (as of 2018-10-04) in an upstream release of libxml2. Full details about the security update are available in Github Issue #1785. [#1785]: https://github.com/sparklemotion/nokogiri/issues/1785 ----- [MRI] Pulled in upstream patches from libxml2 that address CVE-2018-14404 and CVE-2018-14567. Full details are available in #1785. Note that these patches are not yet (as of 2018-10-04) in an upstream release of libxml2. ----- CVE-2018-14404 Permalink: https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14404.html Description: A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application Canonical rates this vulnerability as "Priority: Medium" ----- CVE-2018-14567 Permalink: https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14567.html Description: infinite loop in LZMA decompression Canonical rates this vulnerability as "Priority: Medium"

There are no reported fixed by versions.

VCID-kt4k-xgcs-zkge
Aliases:
CVE-2018-14567

libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.

There are no reported fixed by versions.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-07-31T09:23:11.458483+00:00	GitLab Importer	Affected by	VCID-kt4k-xgcs-zkge	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/nuget/libxml2/CVE-2018-14567.yml	37.0.0
2025-07-31T09:23:03.067154+00:00	GitLab Importer	Affected by	VCID-bpwu-gpw3-qkcp	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/nuget/libxml2/CVE-2018-14404.yml	37.0.0
2025-07-31T09:22:39.230168+00:00	GitLab Importer	Affected by	VCID-5452-mez7-1uf3	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/nuget/libxml2/CVE-2018-9251.yml	37.0.0