Nikita Sveshnikov

The `DOMNode::C14N()` method may process XML data incorrectly, leading to the creation of a circular linked list within the data structure that represents the XML document. This flaw can cause subsequent processing of the document to enter an infinite loop, resulting in a denial of service for the application.

The PDO Firebird driver improperly handles NUL bytes during the preparation of SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied using the `strncat()` function, which terminates at the NUL byte. This action drops the closing quote, causing subsequent SQL tokens to be interpreted as part of the string. This behavior enables SQL injection when attacker-controlled values are processed via the `PDO::quote()` function and embedded in SQL statements.

Lexbor is a web browser engine library. Before version 2.7.0, the ISO‑2022‑JP encoder in Lexbor does not reset the temporary size variable between iterations. The statement `ctx->buffer used -= size` with an outdated size of 3 causes an integer underflow that wraps to SIZE MAX. Subsequently, `memcpy` is called with a negative length, resulting in an out-of-bounds read from the stack and an out-of-bounds write to the heap. The source data is partially controllable through the contents of the DOM tree.

Lexbor is a web browser engine library. A type-confusion issue exists in Lexbor’s HTML fragment parser. When `ns` is UNDEF, a comment is created using the “unknown element” constructor. The comment’s data are written into the element’s fields via an unsafe cast, corrupting the `qualified name` field. This corrupted value is later used as a pointer and dereferenced.

A bug in the `php read stream all chunks()` function allows for the disclosure of sensitive heap memory. This occurs when the `getimagesize()` function reads images in multi-chunk mode, such as through `php://filter` streams, because the buffer is overwritten without advancing the pointer, leaving tail bytes uninitialized. This can leak uninitialized heap memory into APPn segments (e.g., APP1). The issue is triggered when an attacker controls the stream chunk size and crafts a JPEG with a large APP1 segment spanning multiple read chunks.

A NULL pointer dereference issue was discovered in libxml2 when processing XPath XML expressions. This allows an attacker to create malicious XML input, resulting in a denial of service.

A memory corruption issue can be triggered in libxml2 by processing certain sch:name elements from an input XML file. This allows an attacker to craft a malicious XML input file, potentially leading to a denial of service or other undefined behavior due to sensitive data corruption in memory.

A use-after-free issue was found in libxml2, occurring when parsing XPath elements under certain circumstances, specifically when the XML schematron contains the "sch:name path" schema elements. This allows a malicious actor to craft a malicious XML document, potentially causing the program to crash or resulting in undefined behaviors.

Name of the Vulnerable Software and Affected Versions: libxml2 versions prior to 2.9.15 Description: An uncontrolled recursion issue in XPath evaluation within libxml2 allows a local attacker to cause a stack overflow through crafted expressions. The XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` previously reset recursion depth to zero before making potentially recursive calls, enabling uncontrolled recursion and a potential stack overflow when called recursively. These functions now preserve recursion depth across recursive calls, allowing for controlled recursion. Recommendations: Update to libxml2 version 2.9.15 or later.