{"id":"CVE-2015-8806","aliases":["DEBIAN-CVE-2015-8806","DLA-503-1","DSA-3593-1","EUVD-2018-0444","GHSA-7hp2-xwpj-95jq","MGASA-2016-0263","SUSE-SU-2016:1538-1","SUSE-SU-2016:1604-1","SUSE-SU-2017:2699-1","SUSE-SU-2017:2700-1","UBUNTU-CVE-2015-8806","USN-2994-1"],"status":"published","title":"Denial of service or RCE from libxml2 and libxslt","description":"dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the \"\u003c!DOCTYPE html\" substring in a crafted HTML document.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04964,"percentile":0.92249,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2016-04-13T00:00:00Z","modified":"2026-09-09T07:02:01Z","fixes":[{"ecosystem":"RubyGems","package":"nokogiri","fixed_in":["1.6.8"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"libxml2","fixed_in":["2.9.3+dfsg1-1.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxml2","fixed_in":["2.9.3+dfsg1-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxml2","fixed_in":["2.9.3+dfsg1-1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libxml2","fixed_in":["2.9.1+dfsg1-3ubuntu4.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libxml2","fixed_in":["2.9.3+dfsg1-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1.1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.0+dfsg1-7+wheezy6"}]}],"versions":["2.8.0+dfsg1-7+nmu1","2.8.0+dfsg1-7+nmu2","2.8.0+dfsg1-7+nmu3","2.8.0+dfsg1-7+wheezy1","2.8.0+dfsg1-7+wheezy2","2.8.0+dfsg1-7+wheezy3","2.8.0+dfsg1-7+wheezy4","2.8.0+dfsg1-7+wheezy5"],"bundled":15},{"source":"osv","ecosystem":"Debian:8","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-5+deb8u2"}]}],"versions":["2.9.1+dfsg1-5","2.9.1+dfsg1-5+deb8u1"],"bundled":16},{"source":"osv","ecosystem":"RubyGems","package":"nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.8"}]}],"versions":["1.6.0","1.6.1","1.6.2","1.6.2.1","1.6.2.rc1","1.6.2.rc2","1.6.2.rc3","1.6.3","1.6.3.1","1.6.3.rc1","1.6.3.rc2","1.6.3.rc3","1.6.4","1.6.4.1","1.6.5","1.6.6.1","1.6.6.2","1.6.6.3","1.6.6.4","1.6.7","1.6.7.1","1.6.7.2","1.6.7.rc2","1.6.7.rc3","1.6.7.rc4","1.6.8.rc1","1.6.8.rc2","1.6.8.rc3"]},{"source":"osv","ecosystem":"Mageia:5","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-1.1.mga5"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-24.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-24.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-24.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-24.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-24.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-24.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-24.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-24.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-24.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-24.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-24.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-24.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-24.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-24.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.44.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.44.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.44.4"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.44.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.44.4"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.44.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.44.4"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.44.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.44.4"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.44.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.44.4"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.44.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.44.4"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.44.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.44.4"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.44.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-0.44.4"}]}],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-3ubuntu4.8"}]}],"versions":["2.9.1+dfsg1-3ubuntu2","2.9.1+dfsg1-3ubuntu3","2.9.1+dfsg1-3ubuntu4","2.9.1+dfsg1-3ubuntu4.1","2.9.1+dfsg1-3ubuntu4.2","2.9.1+dfsg1-3ubuntu4.3","2.9.1+dfsg1-3ubuntu4.4","2.9.1+dfsg1-3ubuntu4.5","2.9.1+dfsg1-3ubuntu4.6","2.9.1+dfsg1-3ubuntu4.7"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.1"}]}],"versions":["2.9.2+zdfsg1-4","2.9.2+zdfsg1-4ubuntu1","2.9.2+zdfsg1-4ubuntu2","2.9.2+zdfsg1-4ubuntu3","2.9.3+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-3ubuntu4.8"}]}],"versions":["2.9.1+dfsg1-3ubuntu2","2.9.1+dfsg1-3ubuntu3","2.9.1+dfsg1-3ubuntu4","2.9.1+dfsg1-3ubuntu4.1","2.9.1+dfsg1-3ubuntu4.2","2.9.1+dfsg1-3ubuntu4.3","2.9.1+dfsg1-3ubuntu4.4","2.9.1+dfsg1-3ubuntu4.5","2.9.1+dfsg1-3ubuntu4.6","2.9.1+dfsg1-3ubuntu4.7"],"bundled":16},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.1"}]}],"versions":["2.9.2+zdfsg1-4","2.9.2+zdfsg1-4ubuntu1","2.9.2+zdfsg1-4ubuntu2","2.9.2+zdfsg1-4ubuntu3","2.9.3+dfsg1-1"],"bundled":16}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"xmlsoft","product":"libxml2"}],"references":[{"url":"https://bugzilla.gnome.org/show_bug.cgi?id=749115","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","advisory","report","web"]},{"url":"https://www.debian.org/security/2016/dsa-3593","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.ubuntu.com/usn/USN-2994-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2016/02/03/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article","web"]},{"url":"https://security.gentoo.org/glsa/201701-37","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/82071","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8806","tags":["advisory"]},{"url":"https://github.com/sparklemotion/nokogiri/issues/1473","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-8806.yml","tags":["web"]},{"url":"https://web.archive.org/web/20160928171015/http://www.securityfocus.com/bid/82071","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7hp2-xwpj-95jq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-8806","tags":["advisory"]},{"url":"https://github.com/sparklemotion/nokogiri","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2016-0263.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18486","tags":["report"]},{"url":"http://www.xmlsoft.org/news.html","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2016-1292.html","tags":["web"]},{"url":"http://lwn.net/Vulnerabilities/688826/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161538-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/963963","tags":["report"]},{"url":"https://bugzilla.suse.com/965283","tags":["report"]},{"url":"https://bugzilla.suse.com/978395","tags":["report"]},{"url":"https://bugzilla.suse.com/981040","tags":["report"]},{"url":"https://bugzilla.suse.com/981041","tags":["report"]},{"url":"https://bugzilla.suse.com/981108","tags":["report"]},{"url":"https://bugzilla.suse.com/981109","tags":["report"]},{"url":"https://bugzilla.suse.com/981111","tags":["report"]},{"url":"https://bugzilla.suse.com/981112","tags":["report"]},{"url":"https://bugzilla.suse.com/981114","tags":["report"]},{"url":"https://bugzilla.suse.com/981115","tags":["report"]},{"url":"https://bugzilla.suse.com/981548","tags":["report"]},{"url":"https://bugzilla.suse.com/981549","tags":["report"]},{"url":"https://bugzilla.suse.com/981550","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4483","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161604-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172699-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1056193","tags":["report"]},{"url":"https://bugzilla.suse.com/975726","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9233","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172700-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3731","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-8806","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2994-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1762","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1833","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1834","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1835","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1836","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1837","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1838","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1839","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1840","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2073","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3627","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4447","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4449","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4483","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-8806","description":"dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the \"\u003c!DOCTYPE html\" substring in a crafted HTML document.","status":"published","published":"2016-04-13T17:00:00Z","modified":"2024-08-06T08:29:22.04Z","updated_at":"2026-11-02T14:35:40.900357Z"}],"euvd":[{"id":"EUVD-2018-0444","description":"dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the \"\u003c!DOCTYPE html\" substring in a crafted HTML document.","status":"published","published":"2016-04-13T17:00:00Z","modified":"2024-08-06T08:29:22Z","updated_at":"2026-11-03T01:57:25.869767Z"}],"ghsa":[{"id":"GHSA-7hp2-xwpj-95jq","title":"Denial of service or RCE from libxml2 and libxslt","description":"Nokogiri is affected by series of vulnerabilities in libxml2 and libxslt, which are libraries Nokogiri depends on. It was discovered that libxml2 and libxslt incorrectly handled certain malformed documents, which can allow malicious users to cause issues ranging from denial of service to remote code execution attacks.","status":"published","published":"2018-09-17T21:53:42Z","modified":"2023-06-30T19:54:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:36:55.184601Z"}],"nvd":[{"id":"CVE-2015-8806","description":"dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the \"\u003c!DOCTYPE html\" substring in a crafted HTML document.","status":"published","published":"2016-04-13T17:59:07.46Z","modified":"2026-06-17T00:35:17.367Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:03:16.97467Z"}],"osv":[{"id":"CVE-2015-8806","description":"dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the \"\u003c!DOCTYPE html\" substring in a crafted HTML document.","status":"published","published":"2016-04-13T17:59:07Z","modified":"2026-04-16T06:15:16.267432467Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:01.068991Z"},{"id":"DEBIAN-CVE-2015-8806","description":"dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the \"\u003c!DOCTYPE html\" substring in a crafted HTML document.","status":"published","published":"2016-04-13T17:59:07.46Z","modified":"2026-09-09T07:02:01.283982431Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"GHSA-7hp2-xwpj-95jq","title":"Denial of service or RCE from libxml2 and libxslt","description":"Nokogiri is affected by series of vulnerabilities in libxml2 and libxslt, which are libraries Nokogiri depends on. It was discovered that libxml2 and libxslt incorrectly handled certain malformed documents, which can allow malicious users to cause issues ranging from denial of service to remote code execution attacks.","status":"published","published":"2018-09-17T21:53:42Z","modified":"2024-02-16T08:13:35.049095Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:46:41.002603Z"},{"id":"UBUNTU-CVE-2015-8806","description":"dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the \"\u003c!DOCTYPE html\" substring in a crafted HTML document.","status":"published","published":"2016-04-13T00:00:00Z","modified":"2026-04-22T10:23:57.125751Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:11.100633Z"},{"id":"DLA-503-1","title":"libxml2 - security update","status":"published","published":"2016-06-03T00:00:00Z","modified":"2026-03-09T02:11:13.470348Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3593-1","title":"libxml2 - security update","status":"published","published":"2016-06-02T00:00:00Z","modified":"2026-03-09T02:11:30.367494Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0263","title":"Updated libxml2 packages fix security vulnerability","description":"A heap-based buffer overflow flaw was found in the way libxml2 parsed\ncertain crafted XML input. A remote attacker could provide a specially\ncrafted XML file that, when opened in an application linked against\nlibxml2, would cause the application to crash or execute arbitrary code\nwith the permissions of the user running the application (CVE-2016-1834,\nCVE-2016-1840).\n\nMultiple denial of service flaws were found in libxml2. A remote attacker\ncould provide a specially crafted XML file that, when processed by an\napplication using libxml2, could cause that application to crash\n(CVE-2016-1762, CVE-2016-1833, CVE-2016-1835, CVE-2016-1836,\nCVE-2016-1837, CVE-2016-1838, CVE-2016-1839,  CVE-2015-8806,\nCVE-2016-2073, CVE-2016-4483, CVE-2016-4447, CVE-2016-4448,\nCVE-2016-4449).\n\nThe libxml2 package has been updated to version 2.9.4, fixing these issues\nand other bugs.\n","status":"published","published":"2016-07-26T21:59:16Z","modified":"2026-04-16T06:22:47.303254442Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"SUSE-SU-2016:1538-1","title":"Security update for libxml2","description":"\nThis update for libxml2 fixes the following security issues: \n\n- CVE-2016-2073, CVE-2015-8806, CVE-2016-1839: A Heap-buffer overread\n  was fixed in libxml2/dict.c  [bsc#963963, bsc#965283, bsc#981114].\n- CVE-2016-4483: Code was added to avoid an out of bound access when\n  serializing malformed strings [bsc#978395].\n- CVE-2016-1762: Fixed a heap-based buffer overread in xmlNextChar [bsc#981040].\n- CVE-2016-1834: Fixed a heap-buffer-overflow in xmlStrncat [bsc#981041].\n- CVE-2016-1833: Fixed a heap-based buffer overread in htmlCurrentChar [bsc#981108].\n- CVE-2016-1835: Fixed a heap use-after-free in xmlSAX2AttributeNs [bsc#981109].\n- CVE-2016-1837: Fixed a heap use-after-free in htmlParsePubidLiteral\n  and htmlParseSystemiteral [bsc#981111].\n- CVE-2016-1838: Fixed a heap-based buffer overread in\n  xmlParserPrintFileContextInternal [bsc#981112].\n- CVE-2016-1840: Fixed a heap-buffer-overflow in xmlFAParsePosCharGroup [bsc#981115].\n- CVE-2016-4447: Fixed a heap-based buffer-underreads due to xmlParseName [bsc#981548].\n- CVE-2016-4448: Fixed some format string warnings with possible format\n  string vulnerability [bsc#981549],\n- CVE-2016-4449: Fixed inappropriate fetch of entities content [bsc#981550].\n- CVE-2016-3705: Fixed missing increment of recursion counter.\n","status":"published","published":"2016-06-09T12:41:39Z","modified":"2026-02-04T04:38:47.005186Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1604-1","title":"Security update for libxml2","description":"\nThis update for libxml2 fixes the following security issues: \n\n- CVE-2016-2073, CVE-2015-8806, CVE-2016-1839: A Heap-buffer overread\n  was fixed in libxml2/dict.c  [bsc#963963, bsc#965283, bsc#981114].\n- CVE-2016-4483: Code was added to avoid an out of bound access when\n  serializing malformed strings [bsc#978395].\n- CVE-2016-1762: Fixed a heap-based buffer overread in xmlNextChar [bsc#981040].\n- CVE-2016-1834: Fixed a heap-buffer-overflow in xmlStrncat [bsc#981041].\n- CVE-2016-1833: Fixed a heap-based buffer overread in htmlCurrentChar [bsc#981108].\n- CVE-2016-1835: Fixed a heap use-after-free in xmlSAX2AttributeNs [bsc#981109].\n- CVE-2016-1837: Fixed a heap use-after-free in htmlParsePubidLiteral\n  and htmlParseSystemiteral [bsc#981111].\n- CVE-2016-1838: Fixed a heap-based buffer overread in\n  xmlParserPrintFileContextInternal [bsc#981112].\n- CVE-2016-1840: Fixed a heap-buffer-overflow in xmlFAParsePosCharGroup [bsc#981115].\n- CVE-2016-4447: Fixed a heap-based buffer-underreads due to xmlParseName [bsc#981548].\n- CVE-2016-4448: Fixed some format string warnings with possible format\n  string vulnerability [bsc#981549],\n- CVE-2016-4449: Fixed inappropriate fetch of entities content [bsc#981550].\n- CVE-2016-3705: Fixed missing increment of recursion counter.\n","status":"published","published":"2016-06-17T09:21:30Z","modified":"2026-02-04T04:13:51.480971Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2017:2699-1","title":"Security update for SLES 12 Docker image","description":"The SUSE Linux Enterprise Server 12 container image has been updated to include\nsecurity and stability fixes.\n\nThe following issues related to building of the container images have been fixed:\n\n- Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a\n  dependency by the Build Service solver. (bsc#1056193)\n- Do not install recommended packages when building container images. (bsc#975726)\n\nA number of security issues that have been already fixed by updates released for\nSUSE Linux Enterprise Server 12 are now included in the base image. A package/CVE\ncross-reference is available below.\n\npam:\n\n- CVE-2015-3238\n\nlibtasn1:\n\n- CVE-2015-3622\n- CVE-2016-4008\n\nlibidn:\n\n- CVE-2015-2059\n- CVE-2015-8948\n- CVE-2016-6261\n- CVE-2016-6262\n- CVE-2016-6263\n\nzlib:\n\n- CVE-2016-9840\n- CVE-2016-9841\n- CVE-2016-9842\n- CVE-2016-9843\n\ncurl:\n\n- CVE-2016-5419\n- CVE-2016-5420\n- CVE-2016-5421\n- CVE-2016-7141\n- CVE-2016-7167\n- CVE-2016-8615\n- CVE-2016-8616\n- CVE-2016-8617\n- CVE-2016-8618\n- CVE-2016-8619\n- CVE-2016-8620\n- CVE-2016-8621\n- CVE-2016-8622\n- CVE-2016-8623\n- CVE-2016-8624\n- CVE-2016-9586\n- CVE-2017-1000100\n- CVE-2017-1000101\n- CVE-2017-7407\n\nopenssl:\n\n- CVE-2016-2105\n- CVE-2016-2106\n- CVE-2016-2107\n- CVE-2016-2108\n- CVE-2016-2109\n- CVE-2016-2177\n- CVE-2016-2178\n- CVE-2016-2179\n- CVE-2016-2180\n- CVE-2016-2181\n- CVE-2016-2182\n- CVE-2016-2183\n- CVE-2016-6302\n- CVE-2016-6303\n- CVE-2016-6304\n- CVE-2016-6306\n\nlibxml2:\n\n- CVE-2014-0191\n- CVE-2015-8806\n- CVE-2016-1762\n- CVE-2016-1833\n- CVE-2016-1834\n- CVE-2016-1835\n- CVE-2016-1837\n- CVE-2016-1838\n- CVE-2016-1839\n- CVE-2016-1840\n- CVE-2016-2073\n- CVE-2016-3627\n- CVE-2016-3705\n- CVE-2016-4447\n- CVE-2016-4448\n- CVE-2016-4449\n- CVE-2016-4483\n- CVE-2016-4658\n- CVE-2016-9318\n- CVE-2016-9597\n- CVE-2017-9047\n- CVE-2017-9048\n- CVE-2017-9049\n- CVE-2017-9050\n\nutil-linux:\n\n- CVE-2015-5218\n- CVE-2016-5011\n- CVE-2017-2616\n\ncracklib:\n\n- CVE-2016-6318\n\nsystemd:\n\n- CVE-2014-9770\n- CVE-2015-8842\n- CVE-2016-7796\n\npcre:\n\n- CVE-2014-8964\n- CVE-2015-2325\n- CVE-2015-2327\n- CVE-2015-2328\n- CVE-2015-3210\n- CVE-2015-3217\n- CVE-2015-5073\n- CVE-2015-8380\n- CVE-2015-8381\n- CVE-2015-8382\n- CVE-2015-8383\n- CVE-2015-8384\n- CVE-2015-8385\n- CVE-2015-8386\n- CVE-2015-8387\n- CVE-2015-8388\n- CVE-2015-8389\n- CVE-2015-8390\n- CVE-2015-8391\n- CVE-2015-8392\n- CVE-2015-8393\n- CVE-2015-8394\n- CVE-2015-8395\n- CVE-2016-1283\n- CVE-2016-3191\n\nappamor:\n\n- CVE-2017-6507\n\nbash:\n\n- CVE-2014-6277\n- CVE-2014-6278\n- CVE-2016-0634\n- CVE-2016-7543\n\ncpio:\n\n- CVE-2016-2037\n\nglibc:\n\n- CVE-2016-1234\n- CVE-2016-3075\n- CVE-2016-3706\n- CVE-2016-4429\n- CVE-2017-1000366\n\nperl:\n\n- CVE-2015-8853\n- CVE-2016-1238\n- CVE-2016-2381\n- CVE-2016-6185\n\nlibssh2_org:\n\n- CVE-2016-0787\n\nexpat:\n\n- CVE-2012-6702\n- CVE-2015-1283\n- CVE-2016-0718\n- CVE-2016-5300\n- CVE-2016-9063\n- CVE-2017-9233\n\nncurses:\n\n- CVE-2017-10684\n- CVE-2017-10685\n- CVE-2017-11112\n- CVE-2017-11113\n\nlibksba:\n\n- CVE-2016-4574\n- CVE-2016-4579\n\nlibgcrypt:\n\n- CVE-2015-7511\n- CVE-2016-6313\n- CVE-2017-7526\n\ndbus-1:\n\n- CVE-2014-7824\n- CVE-2015-0245\n\nFinally, the following packages received non-security fixes:\n\n- augeas\n- bzip2\n- ca-certificates-mozilla\n- coreutils\n- cryptsetup\n- cyrus-sasl\n- dirmngr\n- e2fsprogs\n- findutils\n- gpg2\n- insserv-compat\n- kmod\n- libcap\n- libsolv\n- libzypp\n- openldap2\n- p11-kit\n- permissions\n- procps\n- rpm\n- sed\n- shadow\n- zypper\n","status":"published","published":"2017-10-10T19:37:24Z","modified":"2026-02-04T03:24:03.922844Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2700-1","title":"Security update for SLES 12-SP1 Docker image","description":"The SUSE Linux Enterprise Server 12 SP1 container image has been updated to include\nsecurity and stability fixes.\n\nThe following issues related to building of the container images have been fixed:\n\n- Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a\n  dependency by the Build Service solver. (bsc#1056193)\n- Do not install recommended packages when building container images. (bsc#975726)\n\nA number of security issues that have been already fixed by updates released for\nSUSE Linux Enterprise Server 12 SP1 are now included in the base image. A package/CVE\ncross-reference is available below.\n\npam:\n\n- CVE-2015-3238\n\nlibtasn1:\n\n- CVE-2015-3622\n- CVE-2016-4008\n\nexpat:\n\nexpat:\n\n- CVE-2012-6702\n- CVE-2015-1283\n- CVE-2016-0718\n- CVE-2016-5300\n- CVE-2016-9063\n- CVE-2017-9233\n\nlibidn:\n\n- CVE-2015-2059\n- CVE-2015-8948\n- CVE-2016-6261\n- CVE-2016-6262\n- CVE-2016-6263\n\n\nzlib:\n\n- CVE-2016-9840\n- CVE-2016-9841\n- CVE-2016-9842\n- CVE-2016-9843\n\ncurl:\n\n- CVE-2016-5419\n- CVE-2016-5420\n- CVE-2016-5421\n- CVE-2016-7141\n- CVE-2016-7167\n- CVE-2016-8615\n- CVE-2016-8616\n- CVE-2016-8617\n- CVE-2016-8618\n- CVE-2016-8619\n- CVE-2016-8620\n- CVE-2016-8621\n- CVE-2016-8622\n- CVE-2016-8623\n- CVE-2016-8624\n- CVE-2016-9586\n- CVE-2017-1000100\n- CVE-2017-1000101\n- CVE-2017-7407\n\nopenssl:\n\n- CVE-2016-2105\n- CVE-2016-2106\n- CVE-2016-2107\n- CVE-2016-2108\n- CVE-2016-2109\n- CVE-2016-2177\n- CVE-2016-2178\n- CVE-2016-2179\n- CVE-2016-2180\n- CVE-2016-2181\n- CVE-2016-2182\n- CVE-2016-2183\n- CVE-2016-6302\n- CVE-2016-6303\n- CVE-2016-6304\n- CVE-2016-6306\n- CVE-2016-7056\n- CVE-2016-8610\n- CVE-2017-3731\n\ncracklib:\n\n- CVE-2016-6318\n\npcre:\n\n- CVE-2014-8964\n- CVE-2015-2325\n- CVE-2015-2327\n- CVE-2015-2328\n- CVE-2015-3210\n- CVE-2015-3217\n- CVE-2015-5073\n- CVE-2015-8380\n- CVE-2015-8381\n- CVE-2015-8382\n- CVE-2015-8383\n- CVE-2015-8384\n- CVE-2015-8385\n- CVE-2015-8386\n- CVE-2015-8387\n- CVE-2015-8388\n- CVE-2015-8389\n- CVE-2015-8390\n- CVE-2015-8391\n- CVE-2015-8392\n- CVE-2015-8393\n- CVE-2015-8394\n- CVE-2015-8395\n- CVE-2016-1283\n- CVE-2016-3191\n\nappamor:\n\n- CVE-2017-6507\n\nbash:\n\n- CVE-2014-6277\n- CVE-2014-6278\n- CVE-2016-0634\n- CVE-2016-7543\n\ncpio:\n\n- CVE-2016-2037\n\nglibc:\n\n- CVE-2016-1234\n- CVE-2016-3075\n- CVE-2016-3706\n- CVE-2016-4429\n- CVE-2017-1000366\n\nperl:\n\n- CVE-2015-8853\n- CVE-2016-1238\n- CVE-2016-2381\n- CVE-2016-6185\n\nlibssh2_org:\n\n- CVE-2016-0787\n\nutil-linux:\n\n- CVE-2016-5011\n- CVE-2017-2616\n\nncurses:\n\n- CVE-2017-10684\n- CVE-2017-10685\n- CVE-2017-11112\n- CVE-2017-11113\n\nlibksba:\n\n- CVE-2016-4574\n- CVE-2016-4579\n\nlibxml2:\n\n- CVE-2014-0191\n- CVE-2015-8806\n- CVE-2016-1762\n- CVE-2016-1833\n- CVE-2016-1834\n- CVE-2016-1835\n- CVE-2016-1837\n- CVE-2016-1838\n- CVE-2016-1839\n- CVE-2016-1840\n- CVE-2016-2073\n- CVE-2016-3627\n- CVE-2016-3705\n- CVE-2016-4447\n- CVE-2016-4448\n- CVE-2016-4449\n- CVE-2016-4483\n- CVE-2016-4658\n- CVE-2016-9318\n- CVE-2016-9597\n- CVE-2017-9047\n- CVE-2017-9048\n- CVE-2017-9049\n- CVE-2017-9050\n\nlibgcrypt:\n\n- CVE-2015-7511\n- CVE-2016-6313\n- CVE-2017-7526\n\nupdate-alternatives:\n\n- CVE-2015-0860\n\nsystemd:\n\n- CVE-2014-9770\n- CVE-2015-8842\n- CVE-2016-7796\n\ndbus-1:\n\n- CVE-2014-7824\n- CVE-2015-0245\n\nFinally, the following packages received non-security fixes:\n\n- augeas\n- bzip2\n- ca-certificates-mozilla\n- coreutils\n- cryptsetup\n- cyrus-sasl\n- dirmngr\n- e2fsprogs\n- findutils\n- gpg2\n- insserv-compat\n- kmod\n- libcap\n- libsolv\n- libzypp\n- lua51\n- lvm2\n- netcfg\n- p11-kit\n- permissions\n- procps\n- rpm\n- sed\n- sg3_utils\n- shadow\n- zypper\n","status":"published","published":"2017-10-10T19:37:36Z","modified":"2026-02-04T03:03:17.897778Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"USN-2994-1","title":"libxml2 vulnerabilities","description":"It was discovered that libxml2 incorrectly handled certain malformed\ndocuments. If a user or automated system were tricked into opening a\nspecially crafted document, an attacker could possibly cause libxml2 to\ncrash, resulting in a denial of service. (CVE-2015-8806, CVE-2016-2073,\nCVE-2016-3627, CVE-2016-3705, CVE-2016-4447)\n\nIt was discovered that libxml2 incorrectly handled certain malformed\ndocuments. If a user or automated system were tricked into opening a\nspecially crafted document, an attacker could cause libxml2 to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2016-1762, CVE-2016-1834)\n\nMateusz Jurczyk discovered that libxml2 incorrectly handled certain\nmalformed documents. If a user or automated system were tricked into\nopening a specially crafted document, an attacker could cause libxml2 to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-1833, CVE-2016-1838, CVE-2016-1839)\n\nWei Lei and Liu Yang discovered that libxml2 incorrectly handled certain\nmalformed documents. If a user or automated system were tricked into\nopening a specially crafted document, an attacker could cause libxml2 to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-1835, CVE-2016-1837)\n\nWei Lei and Liu Yang discovered that libxml2 incorrectly handled certain\nmalformed documents. If a user or automated system were tricked into\nopening a specially crafted document, an attacker could cause libxml2 to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.10 and\nUbuntu 16.04 LTS. (CVE-2016-1836)\n\nKostya Serebryany discovered that libxml2 incorrectly handled certain\nmalformed documents. If a user or automated system were tricked into\nopening a specially crafted document, an attacker could cause libxml2 to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-1840)\n\nIt was discovered that libxml2 would load certain XML external entities. If\na user or automated system were tricked into opening a specially crafted\ndocument, an attacker could possibly obtain access to arbitrary files or\ncause resource consumption. (CVE-2016-4449)\n\nGustavo Grieco discovered that libxml2 incorrectly handled certain\nmalformed documents. If a user or automated system were tricked into\nopening a specially crafted document, an attacker could possibly cause\nlibxml2 to crash, resulting in a denial of service. (CVE-2016-4483)\n","status":"published","published":"2016-06-06T16:43:37Z","modified":"2026-04-22T09:25:46.534551Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}