Monthly
Integer overflow in libxml2 before 2.15.4 passes negative-length values into application-level XML write callbacks when output buffer sizes reach or exceed INT_MAX, enabling out-of-bounds memory reads or writes within any callback that trusts the supplied length parameter. The root cause is a type mismatch: xmlBufUse() returns size_t, but xmlOutputWriteCallback expects int - without an overflow guard, buffers of sufficient size silently wrap to negative values. Applications embedding libxml2 with custom output callbacks and processing attacker-influenced large XML payloads face C:H/I:H impact; the severity is callback-implementation-dependent. No public exploit has been identified at time of analysis.
An integer coercion error was found in the openvswitch kernel module. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Integer overflow in libxml2 before 2.15.4 passes negative-length values into application-level XML write callbacks when output buffer sizes reach or exceed INT_MAX, enabling out-of-bounds memory reads or writes within any callback that trusts the supplied length parameter. The root cause is a type mismatch: xmlBufUse() returns size_t, but xmlOutputWriteCallback expects int - without an overflow guard, buffers of sufficient size silently wrap to negative values. Applications embedding libxml2 with custom output callbacks and processing attacker-influenced large XML payloads face C:H/I:H impact; the severity is callback-implementation-dependent. No public exploit has been identified at time of analysis.
An integer coercion error was found in the openvswitch kernel module. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.