Threats affecting pkg:deb/ubuntu/libxml2

A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS).

A vulnerability in libxml2 with Python bindings enabled allows a remote attacker to cause a denial of service by triggering a double-free error via a specially crafted XML document containing a DTD with enumerated attribute values. This leads to a crash in Python applications using libxml2 SAX bindings. Multiple Ubuntu package versions are affected, and fixes have been released.

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

A use-after-free vulnerability exists in libxml2 when parsing the internal subset of a DTD. This flaw could allow a remote attacker to cause a denial of service or potentially execute arbitrary code. Multiple specific versions of libxml2 are affected. No CVSS score is provided for this vulnerability.