Re: Vulnerabilities fixed in libxml2-2.15.4

[Salvatore Bonaccorso <carnil () debian org>]

Hi,

On Fri, Sep 04, 2026 at 06:35:56PM +0100, Sam James wrote:
> From libxml2-2.15.4:
>
> +v2.15.4: Sep 01 2026
> +
> +### Security
> +
> +- xmlregexp: Prevent out-of-bounds read in NXT macro
> +- fix: add missing overflow checks in dict.c, uri.c, and valid.c
> +- xmlregexp: Calc string length after null checking
> +- xpointer: Check overflow in xmlXPtrEvalXPtrPart
> +- xmlIO: Check for int overflow before calling writecallback
> +- fix(xinclude): propagate parseFlags in xmlXIncludeProcess and xmlXIncludeProcessTree
> +
> + [...]
>
> I possess no further details.

FTR, some CVEs got assigned for issues fixed in 2.15.4: 

https://www.cve.org/CVERecord?id=CVE-2026-86137:
| In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds
| read, aka an out-of-bounds read in the NXT macro in xmlregexp.

https://www.cve.org/CVERecord?id=CVE-2026-86138
| In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer
| overflow and resultant heap-based buffer overflow.

https://www.cve.org/CVERecord?id=CVE-2026-86139
| In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer
| overflow.

https://www.cve.org/CVERecord?id=CVE-2026-86140
| In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat
| stack-based buffer overflow.

https://www.cve.org/CVERecord?id=CVE-2026-86141
| xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in
| xmlRegNewParserCtxt after a strdup failure, i.e., it does not
| calculate a string length after NULL checking.

https://www.cve.org/CVERecord?id=CVE-2026-86142
| In libxml2 before 2.15.4, there is a heap-based buffer overflow in
| xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.

https://www.cve.org/CVERecord?id=CVE-2026-86143
| In xmlIO in libxml2 before 2.15.4, an inconsistency in
| xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach
| write callbacks, aka a lack of a check for integer overflow before
| calling writecallback. This has security relevance for many types of
| uses of that length value within a callback.

https://www.cve.org/CVERecord?id=CVE-2026-86144
| In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and
| xmlXIncludeProcessTree do not propagate parseFlags. This has security
| relevance for, for example, the XML_PARSE_NONET flag, if (without it)
| a custom resource loader accesses the internet and triggers XML
| external entity injection, SSRF, or a denial of service (e.g., for an
| attacker-controlled internet resource that is intentionally slow).

Regards,
Salvatore