/ 
XML-LibXML-1.49 UNAUTHORIZED RELEASE
Security Advisories (3)
CVE-2015-3451 (2015-04-23)

The _clone function does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function.

CVE-2017-10672 (2015-04-23)

Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call.

CVE-2026-8177 (2026-05-10)

XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences. A node name ending in the middle of a multi byte UTF-8 sequence causes the parser to read past the end of the input string into adjacent heap memory. Any Perl process that passes attacker controlled strings to XML::LibXML's DOM node-name methods can reach this path on the default API. The likely consequence is a crash, causing denial of service.

Changes for version 1.49

  • memory management has been completely rewritten. now the module should not cause that many memory leaks (special thanks to Merijn Broeren and Petr Pajas for providing testcases)
  • more libxml2 functions are used
  • DOM API is more Level 3 conform
  • ownerDocument fixed
  • parser validation bug fixed (reported by Erik Ray)
  • made parse_xml_chunk() report errors
  • fixed the PI interface
  • xpath.pl example
  • better namespace support
  • improved NamedNodeMap support
  • restructured the interfaces
  • HTML document nodes are recognized as HTML doc nodes instead of plain nodes
  • XML::LibXML::SAX::Parser able to handle HTML docs now (patch by D. Hageman [dhageman@dracken.com])
  • added serialization flags ($setTagCompression, $skipDtd and $skipXMLDeclaration)
  • more documentation

Documentation

XML::LibXML::Attr
The DOM Attribute Class
XML::LibXML::CDATASection
The DOM CDATASection Class
XML::LibXML::Comment
The DOM Comment Class
XML::LibXML::DOM
XML::LibXML DOM implementation
XML::LibXML::Document
DOM Document Class
XML::LibXML::DocumentFragment
DOM L2 Implementation of a Document Fragment
XML::LibXML::Dtd
A Class implementing Dtd Nodes
XML::LibXML::Element
The DOM Element Class
XML::LibXML::Namespace
A Namespace Class to hold namespace nodes
XML::LibXML::Node
"virtual" Base Class DOM-Nodes
XML::LibXML::Text
The DOM Text Node Class

Modules

XML::LibXML
Interface to the gnome libxml2 library
XML::LibXML::Boolean
Boolean true/false values UNAUTHORIZED
XML::LibXML::Literal
Simple string values. UNAUTHORIZED
XML::LibXML::NodeList
a list of XML document nodes UNAUTHORIZED
XML::LibXML::Number
Simple numeric values. UNAUTHORIZED
XML::LibXML::SAX::Builder
build a LibXML tree from SAX events UNAUTHORIZED
XML::LibXML::SAX::Generator
Generate SAX events from a LibXML tree UNAUTHORIZED
XML::LibXML::SAX::Parser
LibXML DOM based SAX Parser UNAUTHORIZED

Provides

XML::LibXML::Attr
in LibXML.pm
XML::LibXML::CDATASection
in LibXML.pm
XML::LibXML::Comment
in LibXML.pm
XML::LibXML::Document
in LibXML.pm UNAUTHORIZED
XML::LibXML::DocumentFragment
in LibXML.pm
XML::LibXML::Dtd
in LibXML.pm
XML::LibXML::Element
in LibXML.pm
XML::LibXML::NamedNodeMap
in LibXML.pm
XML::LibXML::Namespace
in LibXML.pm
XML::LibXML::Node
in LibXML.pm
XML::LibXML::PI
in LibXML.pm
XML::LibXML::SAX::AttributeNode
in lib/XML/LibXML/SAX/Generator.pm UNAUTHORIZED
XML::LibXML::Text
in LibXML.pm

Examples

Other files