Explore tweets tagged as #Libxml2
Just finished my writeup about CVE-2025-23369, an interesting SAML authentication bypass on GitHub Enterprise Server I reported last year. you can read about it here:
9
94
458
I just made libxml2 memory safe in less than 10 minutes using Fil-C. Passes the test suite. Even the python bindings seem to work
6
9
160
5 CVEs in libxml2 CVE-2025-49794: Heap UAF DoS.CVE-2025-49795: Null pointer dereference DoS.CVE-2025-49796: Type confusion DoS.CVE-2025-6021: Integer and Buffer Overflow in xmlBuildQName().CVE-2025-6170: Stack-based Buffer Overflow in xmllint Shell.
1
12
35
🌐 Celebrating 25 years of Libxml2! 🎉 A testament to open-source success, yet challenges persist. 📉 While it powers so many sectors, support for its sustainability is lacking. #OpenSource #Libxml2 #CommunityMatters
0
0
0
in lxml <= 5.3.2 with libxml2 2.12.x, XXE using parameter entities was possible due to libxml2 behavior - allowing indirect overrides of local DTDs. this worked even without resolve_entities, since libxml2 expanded parameter entities anyway :). it didn’t really make noise since.
What happens when a Dojo challenge collides with a library update? 🔍. The Hex Color Palette challenge used to rely on a specific XXE flow – until lxml changed the rules. Find out why our latest Dojo report includes two different payloads and reports that leak the same flag via
0
1
30
RE: -- libxml2 maintainer will no longer embargo security bugs, and they will be fixed whenever maintainers find time, not ASAP. Good for him! Maybe Apple/Google/et al should adopt or rewrite the project, not rely on unpaid volunteers. Toxic culture.
5
16
100
CVE Binary Tool quick start / README. The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 200 common, vulnerable components (openssl, libpng, libxml2, expat and others), or if you know the components used, you can
1
2
20
Reviving old iphones for test purposes. Here's some cross-compiled debs (confirmed works on iOS6). python3.11.9.libxml2.libxslt.openssl3.
3
4
57
The solo maintainer for libxml2 is no longer accepting embargoed vulnerability reports, citing the unsustainable burden as an unpaid volunteer. Security issues will be treated like any other bug report moving forward. 📄 #cybersecurity #opensource.
0
2
3
⭐️PS5 pacbrew 0.19 released by John Törnblom. 🔹new packages: libzip, libxml2, libsmb2, libnfs, libssh2, libpsl, mesa (swrast/osmesa), glu, glew.🔹zstd: use cmake when building. 📥
1
8
42
this is what you call a “dudes rock moment”
4
24
246
honggfuzz alive and kicking. stack based buffer overflow in libxml2 -
0
19
86
I see threads about libxml2 and libxslt today, so it seems like a good opportunity to talk about sustainability in Free Software again. I'll start with a story that I often repeat to my coworkers when we talk about responsibility silos.
1
1
2
CVE-2024-40896 (CVSS 9.1): Critical XXE Vulnerability Discovered in libxml2
0
25
91
Four flaws in libxml2 (CVE-2025-6021, CVE-2025-49794, CVE-2025-49795, CVE-2025-49796) expose systems to memory corruption, RCE, and DoS attacks. #libxml2 #XMLSecurity #Cybersecurity #Vulnerability #MemoryCorruption.
0
1
0
libxml2で型の取り違えの脆弱性。公式は脆弱性にあたらずとしているがCVE-2025-49796が採番された。未修正。Red Hatは信頼されないXML文書を処理しないことを緩和策としている。
0
1
5
CVE-2025-6021 A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can resu…
0
0
3
