/ 
XML-LibXML-1.57 UNAUTHORIZED RELEASE
Security Advisories (3)
CVE-2015-3451 (2015-04-23)

The _clone function does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function.

CVE-2017-10672 (2015-04-23)

Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call.

CVE-2026-8177 (2026-05-10)

XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences. A node name ending in the middle of a multi byte UTF-8 sequence causes the parser to read past the end of the input string into adjacent heap memory. Any Perl process that passes attacker controlled strings to XML::LibXML's DOM node-name methods can reach this path on the default API. The likely consequence is a crash, causing denial of service.

Changes for version 1.57

  • added cloneNode to XML::LibXML::Document
  • include Schema/RelaxNG code only with libxml2 >= 2.6.0 (to support old libxml2)
  • applied patch to example/cb_example.pl (bug 4262)
  • fixed insertBefore/insertAfter on empty elements (bug 3691)
  • more DOM conformant XML::LibXML->createDocument API (by Robin Berjon)
  • fixed encoding problems with API calls in document encoding
  • improved support for importing DTD subsets
  • fixed DTD validation error reporting problems with libxml2-2.6.x
  • fixed compilation problems with libxml2-2.6.x
  • fixed XML::LibXML::Number to support negative numbers
  • added XML Schema validation interface (XML::LibXML::Schema)
  • added XML RelaxNG validation interface (XML::LibXML::RelaxNG)
  • Michael K. Edwards' patch applied with some amendments from Petr Pajas:
    • add debian build files (I added SKIP_SAX_INSTALL flag for Makefile.PL and changed the patch so that it doesn't disable sax parser registration completely by default, and rather made debian build use this flag)
    • general cleanup (use SV_nolen, etc.)
    • SAX parsers cleanup
    • general error reporting code cleanup/rewrite, try preventing possible memory leaks
    • recover(1) now triggers warnings (disable with $SIG{__WARN__}=sub {})
    • slighlty more strict parse_string behavior (now same as when parsing fh, etc): e.g. parse_string("<foo:bar>"), i.e prefix without NS declaration, raises error unless recover(1) is used
    • documentation fixes/updates
    • slightly updated test set to reflect the new slightly more strict parsing.
  • fixed default c14n XPath to include attributes and namespaces (Petr Pajas)
  • make libxml2's xmlXPathOrderDocElems available through a new $doc->indexElements method
  • added version information of libxml2
  • Les Richardson's documentation patch applied.

Documentation

XML::LibXML::Attr
XML::LibXML Attribute Class
XML::LibXML::CDATASection
XML::LibXML Class for CDATA Sections
XML::LibXML::Comment
XML::LibXML Comment Class
XML::LibXML::DOM
XML::LibXML DOM Implementation
XML::LibXML::Document
XML::LibXML DOM Document Class
XML::LibXML::DocumentFragment
XML::LibXML's DOM L2 Document Fragment Implementation
XML::LibXML::Dtd
XML::LibXML DTD Handling
XML::LibXML::Element
XML::LibXML Class for Element Nodes
XML::LibXML::Namespace
XML::LibXML Namespace Implementation
XML::LibXML::Node
Abstract Base Class of XML::LibXML Nodes
XML::LibXML::PI
XML::LibXML Processing Instructions
XML::LibXML::Parser
Parsing XML Data with XML::LibXML
XML::LibXML::Text
XML::LibXML Class for Text Nodes

Modules

XML::LibXML
Perl Binding for libxml2
XML::LibXML::Boolean
Boolean true/false values UNAUTHORIZED
XML::LibXML::Literal
Simple string values. UNAUTHORIZED
XML::LibXML::NodeList
a list of XML document nodes UNAUTHORIZED
XML::LibXML::Number
Simple numeric values. UNAUTHORIZED
XML::LibXML::SAX
XML::LibXML direct SAX parser
XML::LibXML::SAX::Builder
Building DOM trees from SAX events.
XML::LibXML::SAX::Generator
Generate SAX events from a LibXML tree UNAUTHORIZED

Provides

XML::LibXML::Attr
in LibXML.pm
XML::LibXML::CDATASection
in LibXML.pm
XML::LibXML::Comment
in LibXML.pm
XML::LibXML::Document
in LibXML.pm UNAUTHORIZED
XML::LibXML::DocumentFragment
in LibXML.pm
XML::LibXML::Dtd
in LibXML.pm
XML::LibXML::Element
in LibXML.pm
XML::LibXML::NamedNodeMap
in LibXML.pm
XML::LibXML::Namespace
in LibXML.pm
XML::LibXML::Node
in LibXML.pm
XML::LibXML::PI
in LibXML.pm
XML::LibXML::RelaxNG
in LibXML.pm
XML::LibXML::SAX::AttributeNode
in lib/XML/LibXML/SAX/Generator.pm UNAUTHORIZED
XML::LibXML::SAX::Parser
in lib/XML/LibXML/SAX/Parser.pm UNAUTHORIZED
XML::LibXML::Schema
in LibXML.pm
XML::LibXML::Text
in LibXML.pm
XML::LibXML::_SAXParser
in LibXML.pm

Examples

Other files