LinuxSecurity.com: Drew Yaro of the Apple Product Security Team found two flaws in libxml2. The first is a denial of service flaw in libxml2's XML parser. If an application linked against libxml2 were to process certain malformed XML content, it cause the application to enter an infinite loop (CVE-2008-4225).
libxml(3) Library Functions Manual libxml(3)NAME
libxml - library used to parse XML files
DESCRIPTION
The libxml library is used to parse XML files. Its internal document repesentation is as close as possible to the DOM (Document Object
Model) interface, an API for accessing XML or HTML structured documents.
The libxml library also has a SAX-like interface, which is designed to be compatible with that of another XML parser library called expat.
NOTE: SAX, the Simple API for XML, is a standard interface for event-based XML parsing, developed collaboratively by the members of the
XML-DEV mailing list, currently hosted by OASIS. The expat library is a XML 1.0 parser written in C, which aims to be fully conforming.
It is currently not a validating XML processor.
The libxml library now includes a nearly complete XPath implementation. The XPath (XML Path Language) is a language for addressing parts
of an XML document, designed to be used by both XSLT and XPointer.
The libxml library exports Push and Pull type parser interfaces for both XML and html.
FILES
/usr/lib/libxml2.so shareable library
/usr/bin/xmlcatalog binary application for parsing and manipulating XML or SGML catalog files
/usr/bin/xmllint binary application for parsing XML files
/usr/bin/xml2-config binary application for printing library configuration
/usr/include/libxml2 header files
AUTHORS
Daniel Veillard (daniel@veillard.com). If you download and install this package please send the author email. Manual page by Ziying Sher-
win (sherwin@nlm.nih.gov), Lister Hill National Center for Biomedical Communications, U.S. National Library of Medicine.
SEE ALSO xmlcatalog(1), xmllint(1), xml2-config(1).
NOTES
Source for libxml is available in the SUNWlxmlS package. Documentation for libxml is available on-line at http://www.xmlsoft.org/
23 May 2002 libxml(3)