Hartwork

An integer overflow exists in the `storeAtts()` function. An integer overflow occurs when an arithmetic operation attempts to create a numeric value that is outside of the range that can be represented with a given number of bits.

An issue exists where `XML TOK DATA CHARS` is not considered in the `doCdataSection()` function. This leads to a lack of handler call depth tracking for various calls from within handlers during policy violations, which can result in a use-after-free condition. A use-after-free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed.

An integer overflow occurs in the `XML ParseBuffer()` function because it lacks a specific check that is implemented in the `XML Parse()` function.

The software lacks handler call depth tracking when specific functions are called from within handlers during a policy violation. This can lead to a use-after-free condition, which occurs when a program continues to use a pointer after it has been freed. The affected functions are `XML GetBuffer()`, `XML Parse()`, `XML ParseBuffer()`, `XML ParserFree()`, and `XML ParserReset()`.

The function family `EqualsUri()` can misclassify two unequal URIs as equal.

The software contains pointer difference truncation to int in various locations.

The computational complexity of attribute name collision checks allows a denial of service when processing moderately sized crafted XML input.

The software contains a flaw where parsing DTD content can lead to an infinite loop.

The software contains a flaw where a NULL pointer dereference can occur when processing empty external parameter entity content.

The issue resides in the `XML ExternalEntityParserCreate` function. It does not properly copy user data for unknown encoding handlers, potentially leading to memory corruption. Reports indicate a critical impact on Linux distributions and applications, with the possibility of Remote Code Execution (RCE). The issue is described as an XML External Entity (XXE) flaw.

Bio.Entrez in Biopython allows doctype XML External Entity (XXE), which is a technique where an XML parser is tricked into processing external entities within a document type definition, potentially leading to unauthorized access to local files or server-side request forgery.

The issue is related to the `XML ResumeParser` function in the libexpat library, which can cause a crash due to insufficient checking of unusual or exceptional states. This can be exploited by a remote attacker to cause a denial of service. The `XML StopParser` function can stop or suspend an unstarted parser, leading to the crash.

Name of the Vulnerable Software and Affected Versions: uriparser versions 0.9.7 and earlier Description: An issue in the ComposeQueryEngine function of UriQuery.c in uriparser is related to an integer overflow, which can occur via long keys or values and result in a buffer overflow. This can potentially allow a remote attacker to execute arbitrary code or cause a denial of service. Recommendations: For uriparser versions 0.9.7 and earlier, consider disabling the ComposeQueryEngine function in UriQuery.c as a temporary workaround until a patch is available. Restrict exposure to the vulnerable function to minimize the risk of exploitation. Apply available patches to fix the integer overflow issue. Limit the use of long keys or values in the affected function to prevent buffer overflow.

Name of the Vulnerable Software and Affected Versions: uriparser versions 0.9.7 and earlier Description: The issue is related to an integer overflow in the ComposeQueryMallocExMm function in UriQuery.c, which can be triggered by a long string. This can potentially allow a remote attacker to execute arbitrary code. Recommendations: For uriparser versions 0.9.7 and earlier, consider applying a patch or update when available to fix the integer overflow issue in the ComposeQueryMallocExMm function. As a temporary workaround, consider restricting input to prevent long strings from being processed by the ComposeQueryMallocExMm function until a patch is available.

The issue is related to a use-after-free vulnerability in the `XML ExternalEntityParserCreate` function of the libexpat XML parsing library. This vulnerability can be exploited by a remote attacker to cause a denial of service. The vulnerability occurs due to the overeager destruction of a shared DTD in out-of-memory situations. It may also lead to remote code execution with no additional execution privileges needed, and user interaction is not required for exploitation.

The issue is related to the use of memory after it has been freed, which can be exploited by a remote attacker to cause a denial of service. It performs invalid free operations in `uriFreeUriMembers` and `uriMakeOwner` functions.

The issue is related to the use of memory after it has been freed, which can be exploited by a remote attacker to cause a denial of service. It performs invalid free operations in the `uriNormalizeSyntax` function.

The issue is related to an integer overflow in the `doProlog` function of the `xmlparse.c` file in the Expat library. This could allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability exists due to an integer overflow for `m groupSize`.

The issue is related to a left shift by 29 (or more) places in the `storeAtts` function in xmlparse.c, which can lead to realloc misbehavior, such as allocating too few bytes or only freeing memory. This can cause a denial of service. Additionally, there is a mention of an integer overflow of `addBinding` in xmlparse.c, which could potentially allow a remote attacker to execute arbitrary code on the system by persuading a victim to open a specially-crafted file.

The issue is related to the mishandling of `'` characters in a branch name, which can lead to code execution.