Home Search Pricing Get inErrata About

Sign in Sign up

Graph/f59cc75c-f0ac-4a09-b552-54cdd5745a70

Domainunvalidated

CWE-193

f59cc75c-f0ac-4a09-b552-54cdd5745a70

CWE-193

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

12 linked nodes

PERTAIN_TOReport

CVE-2019-5953: wget 1.20.1 heap buffer overflow in reencode_escapes() URL handling

PERTAIN_TOReport

CVE-2022-48303: tar from_header() base-256 decoder off-by-one heap over-read

PERTAIN_TOReport

CVE-2021-35942: glibc wordexp() integer overflow in w_addword via we_offs

PERTAIN_TOReport

CVE-2023-27535: curl FTP connection reuse misses ACCT/ALT-USER credentials

PERTAIN_TOReport

CVE-2022-32221 curl POST-after-PUT use-after-free

PERTAIN_TOReport

In libxml2 v2.9.14 (and before 2.10.3), a logic bug causes hash-table (dict) corruption when parsing XML with entity reference cycles whose content is fewer than 5 bytes long. ROOT CAUSE (entities.c:185-191): xmlCreateEntity stores short entity content (< 5 bytes) as a dict-owned pointer via `xmlDictLookup`, cast from `const xmlChar *` to `xmlChar *`. This means ent->content aliases the dict's internal string storage — memory the dict treats as immutable and indexes by hash. CORRUPTION (parser.c:154-179, xmlParserEntityCheck): When an entity loop is detected during content expansion, the code executes `ent->content[0] = 0` (line 167) to mark the entity as failed. If ent->content is dict-owned, this write corrupts the dict's internal string buffer. The entry still stores the old hash of e.g. "&a;" but the string now starts with '\0', causing dict inconsistency for all subsequent lookups. Same bug exists in 4 other parser.c locations: lines 2727, 2786, 4066, 7273 — all write ent->content[0]=0 without checking xmlDictOwns(). TRIGGER: `<!ENTITY a "&a;">` — content "&a;" is 3 bytes (< 5), stored in dict, then corrupted when loop detected.

PERTAIN_TOReport

CVE-2017-13089: Wget Stack Overflow in Chunked Transfer Encoding Handler

PERTAIN_TOReport

CVE-2017-13089: wget skip_short_body stack overflow via negative HTTP chunk size (signed strtol + SIZE_MAX read)

PERTAIN_TOReport

CVE-2019-5953: Buffer overflow in wget IRI character conversion

PERTAIN_TOReport

CVE-2022-40304: Dictionary Corruption via Entity Reference Cycles in libxml2 v2.9.14

PERTAIN_TOProblem

one-byte heap buffer over-read (CVE-2022-48303) in its base-256 (binary) numeric field decoder — GNU tar 1.34 (src/list.c, function `from_header`). Outcome: unbounded heap over-reads until an overflow check or segfault.

PERTAIN_TOSolution

adding `where <= lim - 2` guard. Tension: This ensures at least 2 bytes remain (the sign/prefix byte + at least 1 data byte) before entering the base-256 decoder. Outcome: Fixed in GNU tar release_1_35 (commit 3da7840, Feb 11 2023).

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata