OPENSUSE-SU-2024:13165-1
Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00Summary
ruby3.2-rubygem-nokogiri-1.13.9-1.7 on GA media
Severity
Moderate
Notes
Title of the patch: ruby3.2-rubygem-nokogiri-1.13.9-1.7 on GA media
Description of the patch: These are all security issues fixed in the ruby3.2-rubygem-nokogiri-1.13.9-1.7 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2024-13165
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
9.8 (Critical)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
8.8 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
8.8 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
8.8 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
8.8 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
5.3 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
8.1 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
5.4 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
6.6 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
8.1 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
5.3 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
4.3 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
8.8 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
5.9 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
8.6 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
5.9 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
7.5 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
6.5 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
7.5 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
7.5 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
7.5 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
7.5 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
7.1 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
7.8 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
References
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "ruby3.2-rubygem-nokogiri-1.13.9-1.7 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the ruby3.2-rubygem-nokogiri-1.13.9-1.7 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-13165",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_13165-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2013-2877 page",
"url": "https://www.suse.com/security/cve/CVE-2013-2877/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0191 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0191/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-1819 page",
"url": "https://www.suse.com/security/cve/CVE-2015-1819/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-5312 page",
"url": "https://www.suse.com/security/cve/CVE-2015-5312/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7497 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7497/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7498 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7498/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7499 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7499/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7500 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7500/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7941 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7941/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7942 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7942/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-7995 page",
"url": "https://www.suse.com/security/cve/CVE-2015-7995/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-8035 page",
"url": "https://www.suse.com/security/cve/CVE-2015-8035/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-8241 page",
"url": "https://www.suse.com/security/cve/CVE-2015-8241/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-8242 page",
"url": "https://www.suse.com/security/cve/CVE-2015-8242/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-8317 page",
"url": "https://www.suse.com/security/cve/CVE-2015-8317/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-4658 page",
"url": "https://www.suse.com/security/cve/CVE-2016-4658/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-4738 page",
"url": "https://www.suse.com/security/cve/CVE-2016-4738/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-5131 page",
"url": "https://www.suse.com/security/cve/CVE-2016-5131/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-15412 page",
"url": "https://www.suse.com/security/cve/CVE-2017-15412/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-5029 page",
"url": "https://www.suse.com/security/cve/CVE-2017-5029/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-14404 page",
"url": "https://www.suse.com/security/cve/CVE-2018-14404/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-25032 page",
"url": "https://www.suse.com/security/cve/CVE-2018-25032/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-8048 page",
"url": "https://www.suse.com/security/cve/CVE-2018-8048/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-11068 page",
"url": "https://www.suse.com/security/cve/CVE-2019-11068/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20388 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20388/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-5477 page",
"url": "https://www.suse.com/security/cve/CVE-2019-5477/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-24977 page",
"url": "https://www.suse.com/security/cve/CVE-2020-24977/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-7595 page",
"url": "https://www.suse.com/security/cve/CVE-2020-7595/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-30560 page",
"url": "https://www.suse.com/security/cve/CVE-2021-30560/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-3516 page",
"url": "https://www.suse.com/security/cve/CVE-2021-3516/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-3517 page",
"url": "https://www.suse.com/security/cve/CVE-2021-3517/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-3518 page",
"url": "https://www.suse.com/security/cve/CVE-2021-3518/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-3537 page",
"url": "https://www.suse.com/security/cve/CVE-2021-3537/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-3541 page",
"url": "https://www.suse.com/security/cve/CVE-2021-3541/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-41098 page",
"url": "https://www.suse.com/security/cve/CVE-2021-41098/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-23308 page",
"url": "https://www.suse.com/security/cve/CVE-2022-23308/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-23437 page",
"url": "https://www.suse.com/security/cve/CVE-2022-23437/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-24836 page",
"url": "https://www.suse.com/security/cve/CVE-2022-24836/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-24839 page",
"url": "https://www.suse.com/security/cve/CVE-2022-24839/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-29181 page",
"url": "https://www.suse.com/security/cve/CVE-2022-29181/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-29824 page",
"url": "https://www.suse.com/security/cve/CVE-2022-29824/"
}
],
"title": "ruby3.2-rubygem-nokogiri-1.13.9-1.7 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:13165-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"product": {
"name": "ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"product_id": "ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"product": {
"name": "ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"product_id": "ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"product": {
"name": "ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"product_id": "ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64",
"product": {
"name": "ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64",
"product_id": "ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64"
},
"product_reference": "ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le"
},
"product_reference": "ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x"
},
"product_reference": "ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
},
"product_reference": "ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2013-2877",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2013-2877"
}
],
"notes": [
{
"category": "general",
"text": "parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2013-2877",
"url": "https://www.suse.com/security/cve/CVE-2013-2877"
},
{
"category": "external",
"summary": "SUSE Bug 1123919 for CVE-2013-2877",
"url": "https://bugzilla.suse.com/1123919"
},
{
"category": "external",
"summary": "SUSE Bug 828893 for CVE-2013-2877",
"url": "https://bugzilla.suse.com/828893"
},
{
"category": "external",
"summary": "SUSE Bug 829077 for CVE-2013-2877",
"url": "https://bugzilla.suse.com/829077"
},
{
"category": "external",
"summary": "SUSE Bug 854869 for CVE-2013-2877",
"url": "https://bugzilla.suse.com/854869"
},
{
"category": "external",
"summary": "SUSE Bug 877506 for CVE-2013-2877",
"url": "https://bugzilla.suse.com/877506"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2013-2877"
},
{
"cve": "CVE-2014-0191",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0191"
}
],
"notes": [
{
"category": "general",
"text": "The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in Oracle HTTP Server in Oracle Fusion Middleware 11.1.1.7.0, 12.1.2.0, and 12.1.3.0 and other products, loads external parameter entities regardless of whether entity substitution or validation is enabled, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XML document.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0191",
"url": "https://www.suse.com/security/cve/CVE-2014-0191"
},
{
"category": "external",
"summary": "SUSE Bug 1014873 for CVE-2014-0191",
"url": "https://bugzilla.suse.com/1014873"
},
{
"category": "external",
"summary": "SUSE Bug 1123919 for CVE-2014-0191",
"url": "https://bugzilla.suse.com/1123919"
},
{
"category": "external",
"summary": "SUSE Bug 876652 for CVE-2014-0191",
"url": "https://bugzilla.suse.com/876652"
},
{
"category": "external",
"summary": "SUSE Bug 877506 for CVE-2014-0191",
"url": "https://bugzilla.suse.com/877506"
},
{
"category": "external",
"summary": "SUSE Bug 996079 for CVE-2014-0191",
"url": "https://bugzilla.suse.com/996079"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2014-0191"
},
{
"cve": "CVE-2015-1819",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-1819"
}
],
"notes": [
{
"category": "general",
"text": "The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-1819",
"url": "https://www.suse.com/security/cve/CVE-2015-1819"
},
{
"category": "external",
"summary": "SUSE Bug 1123919 for CVE-2015-1819",
"url": "https://bugzilla.suse.com/1123919"
},
{
"category": "external",
"summary": "SUSE Bug 928193 for CVE-2015-1819",
"url": "https://bugzilla.suse.com/928193"
},
{
"category": "external",
"summary": "SUSE Bug 969769 for CVE-2015-1819",
"url": "https://bugzilla.suse.com/969769"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2015-1819"
},
{
"cve": "CVE-2015-5312",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-5312"
}
],
"notes": [
{
"category": "general",
"text": "The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-5312",
"url": "https://www.suse.com/security/cve/CVE-2015-5312"
},
{
"category": "external",
"summary": "SUSE Bug 1123919 for CVE-2015-5312",
"url": "https://bugzilla.suse.com/1123919"
},
{
"category": "external",
"summary": "SUSE Bug 957105 for CVE-2015-5312",
"url": "https://bugzilla.suse.com/957105"
},
{
"category": "external",
"summary": "SUSE Bug 959469 for CVE-2015-5312",
"url": "https://bugzilla.suse.com/959469"
},
{
"category": "external",
"summary": "SUSE Bug 969769 for CVE-2015-5312",
"url": "https://bugzilla.suse.com/969769"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2015-5312"
},
{
"cve": "CVE-2015-7497",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7497"
}
],
"notes": [
{
"category": "general",
"text": "Heap-based buffer overflow in the xmlDictComputeFastQKey function in dict.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7497",
"url": "https://www.suse.com/security/cve/CVE-2015-7497"
},
{
"category": "external",
"summary": "SUSE Bug 1123919 for CVE-2015-7497",
"url": "https://bugzilla.suse.com/1123919"
},
{
"category": "external",
"summary": "SUSE Bug 957106 for CVE-2015-7497",
"url": "https://bugzilla.suse.com/957106"
},
{
"category": "external",
"summary": "SUSE Bug 959469 for CVE-2015-7497",
"url": "https://bugzilla.suse.com/959469"
},
{
"category": "external",
"summary": "SUSE Bug 969769 for CVE-2015-7497",
"url": "https://bugzilla.suse.com/969769"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2015-7497"
},
{
"cve": "CVE-2015-7498",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7498"
}
],
"notes": [
{
"category": "general",
"text": "Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors related to extracting errors after an encoding conversion failure.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7498",
"url": "https://www.suse.com/security/cve/CVE-2015-7498"
},
{
"category": "external",
"summary": "SUSE Bug 1123919 for CVE-2015-7498",
"url": "https://bugzilla.suse.com/1123919"
},
{
"category": "external",
"summary": "SUSE Bug 957107 for CVE-2015-7498",
"url": "https://bugzilla.suse.com/957107"
},
{
"category": "external",
"summary": "SUSE Bug 959469 for CVE-2015-7498",
"url": "https://bugzilla.suse.com/959469"
},
{
"category": "external",
"summary": "SUSE Bug 969769 for CVE-2015-7498",
"url": "https://bugzilla.suse.com/969769"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2015-7498"
},
{
"cve": "CVE-2015-7499",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7499"
}
],
"notes": [
{
"category": "general",
"text": "Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7499",
"url": "https://www.suse.com/security/cve/CVE-2015-7499"
},
{
"category": "external",
"summary": "SUSE Bug 1123919 for CVE-2015-7499",
"url": "https://bugzilla.suse.com/1123919"
},
{
"category": "external",
"summary": "SUSE Bug 957109 for CVE-2015-7499",
"url": "https://bugzilla.suse.com/957109"
},
{
"category": "external",
"summary": "SUSE Bug 959469 for CVE-2015-7499",
"url": "https://bugzilla.suse.com/959469"
},
{
"category": "external",
"summary": "SUSE Bug 969769 for CVE-2015-7499",
"url": "https://bugzilla.suse.com/969769"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2015-7499"
},
{
"cve": "CVE-2015-7500",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7500"
}
],
"notes": [
{
"category": "general",
"text": "The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via unspecified vectors related to incorrect entities boundaries and start tags.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7500",
"url": "https://www.suse.com/security/cve/CVE-2015-7500"
},
{
"category": "external",
"summary": "SUSE Bug 1123919 for CVE-2015-7500",
"url": "https://bugzilla.suse.com/1123919"
},
{
"category": "external",
"summary": "SUSE Bug 957110 for CVE-2015-7500",
"url": "https://bugzilla.suse.com/957110"
},
{
"category": "external",
"summary": "SUSE Bug 959469 for CVE-2015-7500",
"url": "https://bugzilla.suse.com/959469"
},
{
"category": "external",
"summary": "SUSE Bug 969769 for CVE-2015-7500",
"url": "https://bugzilla.suse.com/969769"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2015-7500"
},
{
"cve": "CVE-2015-7941",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7941"
}
],
"notes": [
{
"category": "general",
"text": "libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7941",
"url": "https://www.suse.com/security/cve/CVE-2015-7941"
},
{
"category": "external",
"summary": "SUSE Bug 1123919 for CVE-2015-7941",
"url": "https://bugzilla.suse.com/1123919"
},
{
"category": "external",
"summary": "SUSE Bug 951734 for CVE-2015-7941",
"url": "https://bugzilla.suse.com/951734"
},
{
"category": "external",
"summary": "SUSE Bug 951735 for CVE-2015-7941",
"url": "https://bugzilla.suse.com/951735"
},
{
"category": "external",
"summary": "SUSE Bug 969769 for CVE-2015-7941",
"url": "https://bugzilla.suse.com/969769"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2015-7941"
},
{
"cve": "CVE-2015-7942",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7942"
}
],
"notes": [
{
"category": "general",
"text": "The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7942",
"url": "https://www.suse.com/security/cve/CVE-2015-7942"
},
{
"category": "external",
"summary": "SUSE Bug 1123919 for CVE-2015-7942",
"url": "https://bugzilla.suse.com/1123919"
},
{
"category": "external",
"summary": "SUSE Bug 951735 for CVE-2015-7942",
"url": "https://bugzilla.suse.com/951735"
},
{
"category": "external",
"summary": "SUSE Bug 969769 for CVE-2015-7942",
"url": "https://bugzilla.suse.com/969769"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2015-7942"
},
{
"cve": "CVE-2015-7995",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-7995"
}
],
"notes": [
{
"category": "general",
"text": "The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not check if the parent node is an element, which allows attackers to cause a denial of service via a crafted XML file, related to a \"type confusion\" issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-7995",
"url": "https://www.suse.com/security/cve/CVE-2015-7995"
},
{
"category": "external",
"summary": "SUSE Bug 1123130 for CVE-2015-7995",
"url": "https://bugzilla.suse.com/1123130"
},
{
"category": "external",
"summary": "SUSE Bug 952474 for CVE-2015-7995",
"url": "https://bugzilla.suse.com/952474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2015-7995"
},
{
"cve": "CVE-2015-8035",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-8035"
}
],
"notes": [
{
"category": "general",
"text": "The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-8035",
"url": "https://www.suse.com/security/cve/CVE-2015-8035"
},
{
"category": "external",
"summary": "SUSE Bug 1088279 for CVE-2015-8035",
"url": "https://bugzilla.suse.com/1088279"
},
{
"category": "external",
"summary": "SUSE Bug 1105166 for CVE-2015-8035",
"url": "https://bugzilla.suse.com/1105166"
},
{
"category": "external",
"summary": "SUSE Bug 954429 for CVE-2015-8035",
"url": "https://bugzilla.suse.com/954429"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2015-8035"
},
{
"cve": "CVE-2015-8241",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-8241"
}
],
"notes": [
{
"category": "general",
"text": "The xmlNextChar function in libxml2 2.9.2 does not properly check the state, which allows context-dependent attackers to cause a denial of service (heap-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-8241",
"url": "https://www.suse.com/security/cve/CVE-2015-8241"
},
{
"category": "external",
"summary": "SUSE Bug 1123919 for CVE-2015-8241",
"url": "https://bugzilla.suse.com/1123919"
},
{
"category": "external",
"summary": "SUSE Bug 956018 for CVE-2015-8241",
"url": "https://bugzilla.suse.com/956018"
},
{
"category": "external",
"summary": "SUSE Bug 959469 for CVE-2015-8241",
"url": "https://bugzilla.suse.com/959469"
},
{
"category": "external",
"summary": "SUSE Bug 969769 for CVE-2015-8241",
"url": "https://bugzilla.suse.com/969769"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2015-8241"
},
{
"cve": "CVE-2015-8242",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-8242"
}
],
"notes": [
{
"category": "general",
"text": "The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (stack-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-8242",
"url": "https://www.suse.com/security/cve/CVE-2015-8242"
},
{
"category": "external",
"summary": "SUSE Bug 1123919 for CVE-2015-8242",
"url": "https://bugzilla.suse.com/1123919"
},
{
"category": "external",
"summary": "SUSE Bug 956021 for CVE-2015-8242",
"url": "https://bugzilla.suse.com/956021"
},
{
"category": "external",
"summary": "SUSE Bug 959469 for CVE-2015-8242",
"url": "https://bugzilla.suse.com/959469"
},
{
"category": "external",
"summary": "SUSE Bug 969769 for CVE-2015-8242",
"url": "https://bugzilla.suse.com/969769"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2015-8242"
},
{
"cve": "CVE-2015-8317",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-8317"
}
],
"notes": [
{
"category": "general",
"text": "The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an (1) unterminated encoding value or (2) incomplete XML declaration in XML data, which triggers an out-of-bounds heap read.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-8317",
"url": "https://www.suse.com/security/cve/CVE-2015-8317"
},
{
"category": "external",
"summary": "SUSE Bug 1123919 for CVE-2015-8317",
"url": "https://bugzilla.suse.com/1123919"
},
{
"category": "external",
"summary": "SUSE Bug 956260 for CVE-2015-8317",
"url": "https://bugzilla.suse.com/956260"
},
{
"category": "external",
"summary": "SUSE Bug 959469 for CVE-2015-8317",
"url": "https://bugzilla.suse.com/959469"
},
{
"category": "external",
"summary": "SUSE Bug 969769 for CVE-2015-8317",
"url": "https://bugzilla.suse.com/969769"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2015-8317"
},
{
"cve": "CVE-2016-4658",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-4658"
}
],
"notes": [
{
"category": "general",
"text": "xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-4658",
"url": "https://www.suse.com/security/cve/CVE-2016-4658"
},
{
"category": "external",
"summary": "SUSE Bug 1005544 for CVE-2016-4658",
"url": "https://bugzilla.suse.com/1005544"
},
{
"category": "external",
"summary": "SUSE Bug 1014873 for CVE-2016-4658",
"url": "https://bugzilla.suse.com/1014873"
},
{
"category": "external",
"summary": "SUSE Bug 1069433 for CVE-2016-4658",
"url": "https://bugzilla.suse.com/1069433"
},
{
"category": "external",
"summary": "SUSE Bug 1078813 for CVE-2016-4658",
"url": "https://bugzilla.suse.com/1078813"
},
{
"category": "external",
"summary": "SUSE Bug 1123919 for CVE-2016-4658",
"url": "https://bugzilla.suse.com/1123919"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-4658"
},
{
"cve": "CVE-2016-4738",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-4738"
}
],
"notes": [
{
"category": "general",
"text": "libxslt in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-4738",
"url": "https://www.suse.com/security/cve/CVE-2016-4738"
},
{
"category": "external",
"summary": "SUSE Bug 1005591 for CVE-2016-4738",
"url": "https://bugzilla.suse.com/1005591"
},
{
"category": "external",
"summary": "SUSE Bug 1123130 for CVE-2016-4738",
"url": "https://bugzilla.suse.com/1123130"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-4738"
},
{
"cve": "CVE-2016-5131",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-5131"
}
],
"notes": [
{
"category": "general",
"text": "Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-5131",
"url": "https://www.suse.com/security/cve/CVE-2016-5131"
},
{
"category": "external",
"summary": "SUSE Bug 1014873 for CVE-2016-5131",
"url": "https://bugzilla.suse.com/1014873"
},
{
"category": "external",
"summary": "SUSE Bug 1069433 for CVE-2016-5131",
"url": "https://bugzilla.suse.com/1069433"
},
{
"category": "external",
"summary": "SUSE Bug 1078813 for CVE-2016-5131",
"url": "https://bugzilla.suse.com/1078813"
},
{
"category": "external",
"summary": "SUSE Bug 1123919 for CVE-2016-5131",
"url": "https://bugzilla.suse.com/1123919"
},
{
"category": "external",
"summary": "SUSE Bug 989901 for CVE-2016-5131",
"url": "https://bugzilla.suse.com/989901"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-5131"
},
{
"cve": "CVE-2017-15412",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-15412"
}
],
"notes": [
{
"category": "general",
"text": "Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-15412",
"url": "https://www.suse.com/security/cve/CVE-2017-15412"
},
{
"category": "external",
"summary": "SUSE Bug 1071691 for CVE-2017-15412",
"url": "https://bugzilla.suse.com/1071691"
},
{
"category": "external",
"summary": "SUSE Bug 1077993 for CVE-2017-15412",
"url": "https://bugzilla.suse.com/1077993"
},
{
"category": "external",
"summary": "SUSE Bug 1123129 for CVE-2017-15412",
"url": "https://bugzilla.suse.com/1123129"
},
{
"category": "external",
"summary": "SUSE Bug 1123919 for CVE-2017-15412",
"url": "https://bugzilla.suse.com/1123919"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-15412"
},
{
"cve": "CVE-2017-5029",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-5029"
}
],
"notes": [
{
"category": "general",
"text": "The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-5029",
"url": "https://www.suse.com/security/cve/CVE-2017-5029"
},
{
"category": "external",
"summary": "SUSE Bug 1028848 for CVE-2017-5029",
"url": "https://bugzilla.suse.com/1028848"
},
{
"category": "external",
"summary": "SUSE Bug 1028875 for CVE-2017-5029",
"url": "https://bugzilla.suse.com/1028875"
},
{
"category": "external",
"summary": "SUSE Bug 1035905 for CVE-2017-5029",
"url": "https://bugzilla.suse.com/1035905"
},
{
"category": "external",
"summary": "SUSE Bug 1123130 for CVE-2017-5029",
"url": "https://bugzilla.suse.com/1123130"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2017-5029"
},
{
"cve": "CVE-2018-14404",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-14404"
}
],
"notes": [
{
"category": "general",
"text": "A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-14404",
"url": "https://www.suse.com/security/cve/CVE-2018-14404"
},
{
"category": "external",
"summary": "SUSE Bug 1102046 for CVE-2018-14404",
"url": "https://bugzilla.suse.com/1102046"
},
{
"category": "external",
"summary": "SUSE Bug 1148896 for CVE-2018-14404",
"url": "https://bugzilla.suse.com/1148896"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-14404"
},
{
"cve": "CVE-2018-25032",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-25032"
}
],
"notes": [
{
"category": "general",
"text": "zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-25032",
"url": "https://www.suse.com/security/cve/CVE-2018-25032"
},
{
"category": "external",
"summary": "SUSE Bug 1197459 for CVE-2018-25032",
"url": "https://bugzilla.suse.com/1197459"
},
{
"category": "external",
"summary": "SUSE Bug 1197893 for CVE-2018-25032",
"url": "https://bugzilla.suse.com/1197893"
},
{
"category": "external",
"summary": "SUSE Bug 1198667 for CVE-2018-25032",
"url": "https://bugzilla.suse.com/1198667"
},
{
"category": "external",
"summary": "SUSE Bug 1199104 for CVE-2018-25032",
"url": "https://bugzilla.suse.com/1199104"
},
{
"category": "external",
"summary": "SUSE Bug 1200049 for CVE-2018-25032",
"url": "https://bugzilla.suse.com/1200049"
},
{
"category": "external",
"summary": "SUSE Bug 1201732 for CVE-2018-25032",
"url": "https://bugzilla.suse.com/1201732"
},
{
"category": "external",
"summary": "SUSE Bug 1202688 for CVE-2018-25032",
"url": "https://bugzilla.suse.com/1202688"
},
{
"category": "external",
"summary": "SUSE Bug 1224427 for CVE-2018-25032",
"url": "https://bugzilla.suse.com/1224427"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2018-25032"
},
{
"cve": "CVE-2018-8048",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-8048"
}
],
"notes": [
{
"category": "general",
"text": "In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-8048",
"url": "https://www.suse.com/security/cve/CVE-2018-8048"
},
{
"category": "external",
"summary": "SUSE Bug 1085967 for CVE-2018-8048",
"url": "https://bugzilla.suse.com/1085967"
},
{
"category": "external",
"summary": "SUSE Bug 1086598 for CVE-2018-8048",
"url": "https://bugzilla.suse.com/1086598"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-8048"
},
{
"cve": "CVE-2019-11068",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-11068"
}
],
"notes": [
{
"category": "general",
"text": "libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-11068",
"url": "https://www.suse.com/security/cve/CVE-2019-11068"
},
{
"category": "external",
"summary": "SUSE Bug 1132160 for CVE-2019-11068",
"url": "https://bugzilla.suse.com/1132160"
},
{
"category": "external",
"summary": "SUSE Bug 1154212 for CVE-2019-11068",
"url": "https://bugzilla.suse.com/1154212"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2019-11068"
},
{
"cve": "CVE-2019-20388",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20388"
}
],
"notes": [
{
"category": "general",
"text": "xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20388",
"url": "https://www.suse.com/security/cve/CVE-2019-20388"
},
{
"category": "external",
"summary": "SUSE Bug 1161521 for CVE-2019-20388",
"url": "https://bugzilla.suse.com/1161521"
},
{
"category": "external",
"summary": "SUSE Bug 1191860 for CVE-2019-20388",
"url": "https://bugzilla.suse.com/1191860"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2019-20388"
},
{
"cve": "CVE-2019-5477",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-5477"
}
],
"notes": [
{
"category": "general",
"text": "A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby\u0027s `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-5477",
"url": "https://www.suse.com/security/cve/CVE-2019-5477"
},
{
"category": "external",
"summary": "SUSE Bug 1146578 for CVE-2019-5477",
"url": "https://bugzilla.suse.com/1146578"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2019-5477"
},
{
"cve": "CVE-2020-24977",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-24977"
}
],
"notes": [
{
"category": "general",
"text": "GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-24977",
"url": "https://www.suse.com/security/cve/CVE-2020-24977"
},
{
"category": "external",
"summary": "SUSE Bug 1176179 for CVE-2020-24977",
"url": "https://bugzilla.suse.com/1176179"
},
{
"category": "external",
"summary": "SUSE Bug 1191860 for CVE-2020-24977",
"url": "https://bugzilla.suse.com/1191860"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-24977"
},
{
"cve": "CVE-2020-7595",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-7595"
}
],
"notes": [
{
"category": "general",
"text": "xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-7595",
"url": "https://www.suse.com/security/cve/CVE-2020-7595"
},
{
"category": "external",
"summary": "SUSE Bug 1161517 for CVE-2020-7595",
"url": "https://bugzilla.suse.com/1161517"
},
{
"category": "external",
"summary": "SUSE Bug 1191860 for CVE-2020-7595",
"url": "https://bugzilla.suse.com/1191860"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-7595"
},
{
"cve": "CVE-2021-30560",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-30560"
}
],
"notes": [
{
"category": "general",
"text": "Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-30560",
"url": "https://www.suse.com/security/cve/CVE-2021-30560"
},
{
"category": "external",
"summary": "SUSE Bug 1188373 for CVE-2021-30560",
"url": "https://bugzilla.suse.com/1188373"
},
{
"category": "external",
"summary": "SUSE Bug 1208574 for CVE-2021-30560",
"url": "https://bugzilla.suse.com/1208574"
},
{
"category": "external",
"summary": "SUSE Bug 1211500 for CVE-2021-30560",
"url": "https://bugzilla.suse.com/1211500"
},
{
"category": "external",
"summary": "SUSE Bug 1211501 for CVE-2021-30560",
"url": "https://bugzilla.suse.com/1211501"
},
{
"category": "external",
"summary": "SUSE Bug 1211544 for CVE-2021-30560",
"url": "https://bugzilla.suse.com/1211544"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-30560"
},
{
"cve": "CVE-2021-3516",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-3516"
}
],
"notes": [
{
"category": "general",
"text": "There\u0027s a flaw in libxml2\u0027s xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-3516",
"url": "https://www.suse.com/security/cve/CVE-2021-3516"
},
{
"category": "external",
"summary": "SUSE Bug 1185409 for CVE-2021-3516",
"url": "https://bugzilla.suse.com/1185409"
},
{
"category": "external",
"summary": "SUSE Bug 1191860 for CVE-2021-3516",
"url": "https://bugzilla.suse.com/1191860"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2021-3516"
},
{
"cve": "CVE-2021-3517",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-3517"
}
],
"notes": [
{
"category": "general",
"text": "There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-3517",
"url": "https://www.suse.com/security/cve/CVE-2021-3517"
},
{
"category": "external",
"summary": "SUSE Bug 1185410 for CVE-2021-3517",
"url": "https://bugzilla.suse.com/1185410"
},
{
"category": "external",
"summary": "SUSE Bug 1191860 for CVE-2021-3517",
"url": "https://bugzilla.suse.com/1191860"
},
{
"category": "external",
"summary": "SUSE Bug 1194438 for CVE-2021-3517",
"url": "https://bugzilla.suse.com/1194438"
},
{
"category": "external",
"summary": "SUSE Bug 1196383 for CVE-2021-3517",
"url": "https://bugzilla.suse.com/1196383"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-3517"
},
{
"cve": "CVE-2021-3518",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-3518"
}
],
"notes": [
{
"category": "general",
"text": "There\u0027s a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-3518",
"url": "https://www.suse.com/security/cve/CVE-2021-3518"
},
{
"category": "external",
"summary": "SUSE Bug 1185408 for CVE-2021-3518",
"url": "https://bugzilla.suse.com/1185408"
},
{
"category": "external",
"summary": "SUSE Bug 1191860 for CVE-2021-3518",
"url": "https://bugzilla.suse.com/1191860"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2021-3518"
},
{
"cve": "CVE-2021-3537",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-3537"
}
],
"notes": [
{
"category": "general",
"text": "A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-3537",
"url": "https://www.suse.com/security/cve/CVE-2021-3537"
},
{
"category": "external",
"summary": "SUSE Bug 1185698 for CVE-2021-3537",
"url": "https://bugzilla.suse.com/1185698"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-3537"
},
{
"cve": "CVE-2021-3541",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-3541"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-3541",
"url": "https://www.suse.com/security/cve/CVE-2021-3541"
},
{
"category": "external",
"summary": "SUSE Bug 1186015 for CVE-2021-3541",
"url": "https://bugzilla.suse.com/1186015"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2021-3541"
},
{
"cve": "CVE-2021-41098",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-41098"
}
],
"notes": [
{
"category": "general",
"text": "Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected: Nokogiri::XML::SAX::Parse, Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser, Nokogiri::XML::SAX::PushParser, and Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser. JRuby users should upgrade to Nokogiri v1.12.5 or later to receive a patch for this issue. There are no workarounds available for v1.12.4 or earlier. CRuby users are not affected.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-41098",
"url": "https://www.suse.com/security/cve/CVE-2021-41098"
},
{
"category": "external",
"summary": "SUSE Bug 1191029 for CVE-2021-41098",
"url": "https://bugzilla.suse.com/1191029"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2021-41098"
},
{
"cve": "CVE-2022-23308",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-23308"
}
],
"notes": [
{
"category": "general",
"text": "valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-23308",
"url": "https://www.suse.com/security/cve/CVE-2022-23308"
},
{
"category": "external",
"summary": "SUSE Bug 1196490 for CVE-2022-23308",
"url": "https://bugzilla.suse.com/1196490"
},
{
"category": "external",
"summary": "SUSE Bug 1199098 for CVE-2022-23308",
"url": "https://bugzilla.suse.com/1199098"
},
{
"category": "external",
"summary": "SUSE Bug 1202688 for CVE-2022-23308",
"url": "https://bugzilla.suse.com/1202688"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2022-23308"
},
{
"cve": "CVE-2022-23437",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-23437"
}
],
"notes": [
{
"category": "general",
"text": "There\u0027s a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-23437",
"url": "https://www.suse.com/security/cve/CVE-2022-23437"
},
{
"category": "external",
"summary": "SUSE Bug 1195108 for CVE-2022-23437",
"url": "https://bugzilla.suse.com/1195108"
},
{
"category": "external",
"summary": "SUSE Bug 1196394 for CVE-2022-23437",
"url": "https://bugzilla.suse.com/1196394"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2022-23437"
},
{
"cve": "CVE-2022-24836",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-24836"
}
],
"notes": [
{
"category": "general",
"text": "Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `\u003c v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `\u003e= 1.13.4`. There are no known workarounds for this issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-24836",
"url": "https://www.suse.com/security/cve/CVE-2022-24836"
},
{
"category": "external",
"summary": "SUSE Bug 1198408 for CVE-2022-24836",
"url": "https://bugzilla.suse.com/1198408"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2022-24836"
},
{
"cve": "CVE-2022-24839",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-24839"
}
],
"notes": [
{
"category": "general",
"text": "org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `\u003e= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-24839",
"url": "https://www.suse.com/security/cve/CVE-2022-24839"
},
{
"category": "external",
"summary": "SUSE Bug 1198404 for CVE-2022-24839",
"url": "https://bugzilla.suse.com/1198404"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2022-24839"
},
{
"cve": "CVE-2022-29181",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-29181"
}
],
"notes": [
{
"category": "general",
"text": "Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-29181",
"url": "https://www.suse.com/security/cve/CVE-2022-29181"
},
{
"category": "external",
"summary": "SUSE Bug 1199782 for CVE-2022-29181",
"url": "https://bugzilla.suse.com/1199782"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2022-29181"
},
{
"cve": "CVE-2022-29824",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-29824"
}
],
"notes": [
{
"category": "general",
"text": "In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don\u0027t check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2\u0027s buffer functions, for example libxslt through 1.1.35, is affected as well.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-29824",
"url": "https://www.suse.com/security/cve/CVE-2022-29824"
},
{
"category": "external",
"summary": "SUSE Bug 1199132 for CVE-2022-29824",
"url": "https://bugzilla.suse.com/1199132"
},
{
"category": "external",
"summary": "SUSE Bug 1202878 for CVE-2022-29824",
"url": "https://bugzilla.suse.com/1202878"
},
{
"category": "external",
"summary": "SUSE Bug 1204121 for CVE-2022-29824",
"url": "https://bugzilla.suse.com/1204121"
},
{
"category": "external",
"summary": "SUSE Bug 1204131 for CVE-2022-29824",
"url": "https://bugzilla.suse.com/1204131"
},
{
"category": "external",
"summary": "SUSE Bug 1205069 for CVE-2022-29824",
"url": "https://bugzilla.suse.com/1205069"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.aarch64",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.ppc64le",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.s390x",
"openSUSE Tumbleweed:ruby3.2-rubygem-nokogiri-1.13.9-1.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2022-29824"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…