/ 
XML-LibXML-1.51 UNAUTHORIZED RELEASE
Security Advisories (3)
CVE-2015-3451 (2015-04-23)

The _clone function does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function.

CVE-2017-10672 (2015-04-23)

Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call.

CVE-2026-8177 (2026-05-10)

XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences. A node name ending in the middle of a multi byte UTF-8 sequence causes the parser to read past the end of the input string into adjacent heap memory. Any Perl process that passes attacker controlled strings to XML::LibXML's DOM node-name methods can reach this path on the default API. The likely consequence is a crash, causing denial of service.

Changes for version 1.51

  • fixed parser bug with broken XML declarations
  • fixed memory management within documents that have subsets
  • fixed some threaded perl issues (special thanks to andreas koenig for the patch)
  • applied Win32 tests (special thanks to randy kobes for the patch)
  • fixed findnodes() and find() to return empty arrays in array context if the statement was legal but produced no result.
  • fixed namespace handling in xpath functions
  • fixed local namespace handling in DOM functions
  • pretty formating to all serializing functions *NOTE* the XML::LibXML::Node::toString interface changed check the XML::LibXML::Node man page
  • made xpath functions verbose to perl (one can wrap evals now)
  • improved native SAX interface
  • improved XML::LibXML::SAX::Builder
  • added getNamespaces to the node interface
  • better libxml2 version testing
  • more documentation

Documentation

XML::LibXML::Attr
The DOM Attribute Class
XML::LibXML::CDATASection
The DOM CDATASection Class
XML::LibXML::Comment
The DOM Comment Class
XML::LibXML::DOM
XML::LibXML DOM implementation
XML::LibXML::Document
DOM Document Class
XML::LibXML::DocumentFragment
DOM L2 Implementation of a Document Fragment
XML::LibXML::Dtd
A Class implementing Dtd Nodes
XML::LibXML::Element
The DOM Element Class
XML::LibXML::Namespace
A Namespace Class to hold namespace nodes
XML::LibXML::Node
"virtual" Base Class DOM-Nodes
XML::LibXML::Text
The DOM Text Node Class

Modules

XML::LibXML
Interface to the gnome libxml2 library
XML::LibXML::Boolean
Boolean true/false values UNAUTHORIZED
XML::LibXML::Literal
Simple string values. UNAUTHORIZED
XML::LibXML::NodeList
a list of XML document nodes UNAUTHORIZED
XML::LibXML::Number
Simple numeric values. UNAUTHORIZED
XML::LibXML::SAX
XML::LibXML direct SAX parser
XML::LibXML::SAX::Builder
build a LibXML tree from SAX events UNAUTHORIZED
XML::LibXML::SAX::Generator
Generate SAX events from a LibXML tree UNAUTHORIZED
XML::LibXML::SAX::Parser
LibXML DOM based SAX Parser UNAUTHORIZED

Provides

XML::LibXML::Attr
in LibXML.pm
XML::LibXML::CDATASection
in LibXML.pm
XML::LibXML::Comment
in LibXML.pm
XML::LibXML::Document
in LibXML.pm UNAUTHORIZED
XML::LibXML::DocumentFragment
in LibXML.pm
XML::LibXML::Dtd
in LibXML.pm
XML::LibXML::Element
in LibXML.pm
XML::LibXML::NamedNodeMap
in LibXML.pm
XML::LibXML::Namespace
in LibXML.pm
XML::LibXML::Node
in LibXML.pm
XML::LibXML::PI
in LibXML.pm
XML::LibXML::SAX::AttributeNode
in lib/XML/LibXML/SAX/Generator.pm UNAUTHORIZED
XML::LibXML::Text
in LibXML.pm
XML::LibXML::_SAXParser
in LibXML.pm

Examples

Other files