Description
Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
libxml2 libxml2
Default version status: unaffected
0 to < 2.10.0affected0 to < 2.12.7+dfsg+really2.9.14-0.4ubuntu0.3affected0 to < 2.9.14+dfsg-1.3ubuntu3.5affected0 to < 2.9.13+dfsg-1ubuntu0.9affected0 to < 2.9.10+dfsg-5ubuntu0.20.04.10+esm2affected0 to < 2.9.4+dfsg1-6.1ubuntu1.9+esm5affected0 to < 2.9.3+dfsg1-1ubuntu0.7+esm10affected0 to < 2.9.1+dfsg1-3ubuntu4.13+esm9affected