pkg:Debian/libxml2
172 total CVEsCRITICAL14HIGH56MEDIUM37LOW3
✅ Check your installed version
All known vulnerabilities
- CRITICAL9.8CVE-2024-56171libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmls…from 0, < 2.9.10+dfsg-6.7+deb11u6
- from 0, < 2.9.4+dfsg1-2.1
- from 0, < 2.9.1+dfsg1-5+deb8u4
- from 0, < 2.8.0+dfsg1-7+wheezy7
- CRITICAL9.8CVE-2017-7376Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling…from 0, < 2.9.4+dfsg1-3.1
- from 0, < 2.9.4+dfsg1-3.1
- from 0, < 2.8.0+dfsg1-7+wheezy8
- from 0, < 2.8.0+dfsg1-7+wheezy11
- from 0, < 2.9.4+dfsg1-3.1
- CRITICAL9.8CVE-2016-4448Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vec…from 0, < 2.9.4+dfsg1-1
- CRITICAL9.8CVE-2015-8710The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-o…from 0, < 2.9.2+really2.9.1+dfsg1-0.1
- from 0, < 2.9.10+dfsg-6.7+deb11u8
- from 0, < 2.9.10+dfsg-6.7+deb11u8
- CRITICAL9.1CVE-2017-8872The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or info…from 0, < 2.9.4+dfsg1-6.1
- from 0, < 2.9.10+dfsg-6.6
- from 0, < 2.9.4+dfsg1-5.2
- from 0, < 2.8.0+dfsg1-7+wheezy12
- from 0, < 2.9.1+dfsg1-5+deb8u6
- from 0, < 2.8.0+dfsg1-7+wheezy10
- from 0, < 2.9.4+dfsg1-5.1
- HIGH8.8CVE-2016-5131Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a den…from 0, < 2.9.4+dfsg1-2.1
- HIGH8.8CVE-2016-1835Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2 and OS X before…from 0, < 2.9.3+dfsg1-1.1
- from 0, < 2.9.10+dfsg-6.6
- HIGH8.1CVE-2016-1762The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a c…from 0, < 2.9.3+dfsg1-1.1
- HIGH7.8CVE-2025-7425Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptrfrom 0, < 2.9.14+dfsg-1.3~deb12u4
- from 0, < 2.9.10+dfsg-6.7+deb11u6
- from 0, < 2.9.14+dfsg-1.3~deb12u2
- from 0, < 2.9.10+dfsg-6.7+deb11u6
- from 0, < 2.9.10+dfsg-6.7+deb11u3
- from 0, < 2.9.10+dfsg-6.6
- from 0, < 2.9.4+dfsg1-2.2+deb9u4
- from 0, < 2.9.4+dfsg1-3.1
- from 0, < 2.8.0+dfsg1-7+wheezy9
- from 0, < 2.9.1+dfsg1-5+deb8u5
- HIGH7.8CVE-2016-1840Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 1…from 0, < 2.9.3+dfsg1-1.1
- HIGH7.8CVE-2016-1834Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS…from 0, < 2.9.3+dfsg1-1.1
- HIGH7.7CVE-2025-24928libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c.from 0, < 2.9.10+dfsg-6.7+deb11u6
- from 0
- HIGH7.5CVE-2025-12863A flaw was found in the xmlSetTreeDoc() function of the libxml2 XML parsing library.from 0
- HIGH7.5CVE-2025-49795A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions.from 0
- HIGH7.5CVE-2025-6021Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2from 0, < 2.9.10+dfsg-6.7+deb11u8
- HIGH7.5CVE-2025-32415In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read.from 0, < 2.9.10+dfsg-6.7+deb11u7
- from 0, < 2.9.10+dfsg-6.7+deb11u7
- from 0, < 2.9.10+dfsg-6.7+deb11u7
- HIGH7.5CVE-2025-27113libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.from 0, < 2.9.10+dfsg-6.7+deb11u6
- from 0, < 2.9.10+dfsg-6.7+deb11u8
- from 0, < 2.9.10+dfsg-6.7+deb11u8
- from 0, < 2.9.10+dfsg-6.7+deb11u6
- from 0, < 2.9.4+dfsg1-7+deb10u5
- from 0, < 2.9.10+dfsg-6.7+deb11u3
- from 0, < 2.9.10+dfsg-6.7+deb11u3
- from 0, < 2.9.10+dfsg-2
- HIGH7.5CVE-2022-23308valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.from 0, < 2.9.10+dfsg-6.7+deb11u1
- HIGH7.5CVE-2020-7595libxml as used in Nokogiri has an infinite loop in a certain end-of-file situationfrom 0, < 2.9.10+dfsg-2.1
- HIGH7.5CVE-2019-20388xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.from 0, < 2.9.10+dfsg-2.1
- from 0, < 2.9.1+dfsg1-5+deb8u8
- from 0, < 2.9.10+dfsg-2
- from 0, < 2.9.10+dfsg-2
- from 0, < 2.8.0+dfsg1-7+wheezy6
- from 0, < 2.9.3+dfsg1-1.1
- from 0, < 2.9.1+dfsg1-5+deb8u2
- from 0, < 2.9.4+dfsg1-3.1
- HIGH7.5CVE-2017-9049libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c.from 0, < 2.9.4+dfsg1-3.1
- HIGH7.5CVE-2017-9048libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow.from 0, < 2.9.4+dfsg1-3.1
- from 0, < 2.9.4+dfsg1-3.1
- HIGH7.5CVE-2016-4483The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-…from 0, < 2.9.3+dfsg1-1.1
- HIGH7.5CVE-2016-4447The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-…from 0, < 2.9.3+dfsg1-1.1
- HIGH7.5CVE-2016-3705The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recur…from 0, < 2.9.3+dfsg1-1.1
- HIGH7.5CVE-2016-3627The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to…from 0, < 2.9.3+dfsg1-1.1
- HIGH7.1CVE-2016-4449XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validat…from 0, < 2.9.3+dfsg1-1.1
- MEDIUM6.5CVE-2023-45322libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails.from 0, < 2.9.10+dfsg-6.7+deb11u6
- MEDIUM6.5CVE-2023-39615Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c.from 0, < 2.9.10+dfsg-6.7+deb11u6
- from 0, < 2.9.10+dfsg-6.7+deb11u4
- from 0, < 2.9.4+dfsg1-7+deb10u6
- from 0, < 2.9.10+dfsg-6.7+deb11u4
- from 0, < 2.9.10+dfsg-6.7+deb11u4
- from 0, < 2.9.4+dfsg1-2.2+deb9u7
- from 0, < 2.9.10+dfsg-6.7+deb11u2
- from 0, < 2.9.4+dfsg1-7+deb10u4
- from 0, < 2.9.4+dfsg1-2.2+deb9u5
- from 0, < 2.9.10+dfsg-6.7
- MEDIUM6.5CVE-2020-24977GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c.from 0, < 2.9.10+dfsg-6.2
- MEDIUM6.5CVE-2018-14567libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that tri…from 0, < 2.9.10+dfsg-2
- from 0, < 2.9.10+dfsg-2
- from 0, < 2.9.4+dfsg1-2.2+deb9u3
- from 0, < 2.9.1+dfsg1-5+deb8u7
- MEDIUM6.5CVE-2016-2073The htmlParseNameComplex function in HTMLparser.c in libxml2 allows attackers to cause a denial of service (out-of-bounds read) via a craft…from 0, < 2.9.3+dfsg1-1.1
- MEDIUM6.5CVE-2009-2416Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent a…from 0, < 2.7.3.dfsg-2.1
- from 0, < 2.6.32.dfsg-2+lenny1
- from 0, < 2.6.32.dfsg-3
- from 0, < 2.6.27.dfsg-3
- MEDIUM6.2CVE-2026-1757A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input i…from 0
- from 0, < 2.9.10+dfsg-6.7+deb11u5
- from 0, < 2.9.10+dfsg-6.7+deb11u5
- from 0
- from 0, < 2.9.10+dfsg-6.6
- from 0, < 2.9.10+dfsg-6.7+deb11u9
- from 0, < 2.9.10+dfsg-6.7+deb11u9
- from 0, < 2.9.10+dfsg-2
- from 0, < 2.9.4+dfsg1-2.2+deb9u6
- MEDIUM5.5CVE-2016-1839The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watch…from 0, < 2.9.3+dfsg1-1.1
- MEDIUM5.5CVE-2016-1838The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before…from 0, < 2.9.3+dfsg1-1.1
- MEDIUM5.5CVE-2016-1837Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in libxml2 before 2.9.4, a…from 0, < 2.9.3+dfsg1-1.1
- MEDIUM5.5CVE-2016-1836Use-after-free vulnerability in the xmlDictComputeFastKey function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before…from 0, < 2.9.3+dfsg1-1.1
- MEDIUM5.5CVE-2016-1833The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchO…from 0, < 2.9.3+dfsg1-1.1
- from 0, < 2.9.10+dfsg-6.7+deb11u5
- MEDIUM4.7CVE-2017-5969libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML…from 0, < 2.9.4+dfsg1-5.1
- LOW3.7CVE-2026-0989A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled.from 0
- from 0
- LOW2.5CVE-2025-6170A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files.from 0, < 2.9.10+dfsg-6.7+deb11u8
- from 0
- from 0, < 2.9.3+dfsg1-1
- from 0, < 2.9.3+dfsg1-1
- from 0, < 2.7.8.dfsg-2+squeeze16
- from 0, < 2.8.0+dfsg1-7+wheezy5
- from 0, < 2.9.2+really2.9.1+dfsg1-0.1
- from 0, < 2.7.8.dfsg-2+squeeze12
- —CVE-2015-8317The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an…from 0, < 2.9.2+zdfsg1-4
- —CVE-2015-8242The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-dependent attackers…from 0, < 2.9.3+dfsg1-1
- from 0, < 2.7.8.dfsg-2+squeeze15
- from 0, < 2.9.3+dfsg1-1
- —CVE-2015-7500The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (out-of-bound…from 0, < 2.9.3+dfsg1-1
- —CVE-2015-7498Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause…from 0, < 2.9.3+dfsg1-1
- —CVE-2015-7497Heap-based buffer overflow in the xmlDictComputeFastQKey function in dict.c in libxml2 before 2.9.3 allows context-dependent attackers to c…from 0, < 2.9.3+dfsg1-1
- —CVE-2015-8035The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to…from 0, < 2.9.3+dfsg1-1
- from 0, < 2.7.8.dfsg-2+squeeze13
- from 0, < 2.9.3+dfsg1-1
- —CVE-2015-7941libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-b…from 0, < 2.9.2+really2.9.1+dfsg1-0.1
- from 0, < 2.8.0+dfsg1-7+wheezy3
- from 0, < 2.7.8.dfsg-2+squeeze11
- from 0, < 2.9.1+dfsg1-4
- from 0, < 2.8.0+dfsg1-7+wheezy2
- from 0, < 2.7.8.dfsg-2+squeeze10
- from 0, < 2.9.2+dfsg1-1
- —CVE-2013-0339libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or…from 0, < 2.8.0+dfsg1-7+nmu1
- from 0, < 2.9.1+dfsg1-1
- from 0, < 2.7.8.dfsg-2+squeeze8
- from 0, < 2.8.0+dfsg1-7+nmu1
- from 0, < 2.7.8.dfsg-2+squeeze7
- from 0, < 2.7.8.dfsg-2+squeeze3
- from 0, < 2.7.8.dfsg-8
- from 0, < 2.8.0+dfsg1-7
- from 0, < 2.7.8.dfsg-2+squeeze6
- from 0, < 2.8.0+dfsg1-5
- from 0, < 2.7.8.dfsg-2+squeeze5
- from 0, < 2.7.8.dfsg-9.1
- from 0, < 2.7.8.dfsg-2+squeeze4
- —CVE-2011-3919Heap-based buffer overflow in libxml2, as used in Google Chrome before 16.0.912.75, allows remote attackers to cause a denial of service or…from 0, < 2.7.8.dfsg-7
- —CVE-2011-3905libxml2, as used in Google Chrome before 16.0.912.63, allows remote attackers to cause a denial of service (out-of-bounds read) via unspeci…from 0, < 2.7.8.dfsg-5.1
- —CVE-2011-2834Double free vulnerability in libxml2, as used in Google Chrome before 14.0.835.163, allows remote attackers to cause a denial of service or…from 0, < 2.7.8.dfsg-5
- from 0, < 2.6.32.dfsg-5+lenny4
- from 0, < 2.7.8.dfsg-3
- —CVE-2011-2821Double free vulnerability in libxml2, as used in Google Chrome before 13.0.782.215, allows remote attackers to cause a denial of service or…from 0, < 2.7.8.dfsg-5
- from 0, < 2.7.8.dfsg-5.1
- from 0, < 2.7.8.dfsg-2+squeeze2
- from 0, < 2.6.32.dfsg-5+lenny3
- from 0, < 2.7.8.dfsg-2
- from 0, < 2.7.8.dfsg-1
- from 0, < 2.6.32.dfsg-5+lenny2
- from 0, < 2.6.27.dfsg-6+etch1
- from 0, < 2.7.3.dfsg-2.1
- —CVE-2008-4226Integer overflow in the xmlSAX2Characters function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (memory…from 0, < 2.6.32.dfsg-5
- from 0, < 2.6.32.dfsg-5
- from 0, < 2.6.27.dfsg-6
- from 0, < 2.6.27.dfsg-5
- from 0, < 2.6.32.dfsg-4
- from 0, < 2.6.27.dfsg-2
- from 0, < 2.6.30.dfsg-3.1
- from 0, < 2.4.19-4woody2
- from 0, < 2.6.11-5
- from 0, < 2.4.19-4woody1
- from 0, < 2.6.6-1