#libxml
LightNews LightNews
the-brute-force.bsky.social
I feel bad about all the wasted time I spent trying to figure something out. I was going to use XML + Zip64 for a message format, but I didn't know the version of libxml available on iOS. I was building an app to get the version installed at runtime so I didn't have issues with the structs.
November 6, 2026 at 5:27 AM
hugovalters.bsky.social
CVE-2026-94108: XXE in getID3 (through 1.9.26) lets crafted media metadata leak local files, trigger SSRF, or DoS via entity expansion on PHP under 8.0. CVSS 6.5, unpatched. Patch status unknown - harden libxml and update now. https://www.valtersit.com/cve/CVE-2026-94108/
November 1, 2026 at 5:40 AM
offseq.bsky.social
Red Hat perl-XML-LibXML faces HIGH severity vuln (CVE-2026-8177) – attackers can trigger Denial of Service with malformed UTF-8. Update affected systems promptly. https://radar.offseq.com/threat/red-hat-security-advisory-perl-xml-libxml-security-update-410e28a1121fd06c #OffSeq #RedHat #Vulnerability
Red Hat Security Advisory: perl-XML-LibXML security update
This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing and manipulating XML files. This module allows Perl programmers to make use of the highly capable validating XML parser and the high
radar.offseq.com
October 30, 2026 at 12:00 AM
latte.bsky.plasmatrap.com
🚨🚨🚨 ZLIB/libXML/liblzma/bash IS SINGLE MAINTAINER SLOP
October 25, 2026 at 4:30 PM
lwn.net.web.brid.gy
Security updates for Monday
Security updates have been issued by **AlmaLinux** (ca-certificates, cockpit-machines, container-tools:4.0, expat, flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac, golang-github-openprinting-ipp-usb, grafana-pcp, hplip, kernel, nodejs:14, nodejs:18, openssl, php:7.2, php:7.3, php:8.0, php:8.1, podman, postgresql16-pgvector, postgresql18-pgvector, and python39:3.9 and python39-devel:3.9), **Debian** (brotli, caddy, imagemagick, libdatetime-timezone-perl, libheif, openjdk-17, openssl, thunderbird, tzdata, varnish, and xdg-dbus-proxy), **Fedora** (btrfs-backup-ng, chromium, dotnet10.0, dotnet8.0, dotnet9.0, firefox, gegl04, GitPython, ImageMagick, jfrog-cli, libindi, mingw-libpng, mingw-LibRaw, mingw-python-lxml, mupdf, nix, openssh, perl-Badger, perl-CLI-Simple, perl-Cpanel-JSON-XS, perl-CSS-Inliner, perl-Encoding-FixLatin, perl-HTML-Query, perl-Markdown-Render, perl-Text-CSV_XS, perl-Text-Markdown-Discount, pgbouncer, php-pecl-mongodb2, podofo, rt, and thunderbird), **Mageia** (bind, bluez, iperf, kernel-linus, and nss, rootcerts), **Oracle** (ca-certificates, cockpit-machines, expat, go-toolset:ol8, golang-github-openprinting-ipp-usb, grafana, grafana-pcp, httpd, iperf3, openssh, and podman), **Red Hat** (freeipmi), and **SUSE** (alloy, amazon-ecs-init, aspell, aws-iam-authenticator, ca-certificates-mozilla, cifs-utils, container-suseconnect, cosign, cpupower, docker, elemental3, emacs, expat, fetchmail, ffmpeg-7, firefox-esr, ghostscript, gimp, glibc, go1.26, go1.27, google-osconfig-agent, guava, haproxy, helm, iscsiuio, jfrog-cli, kernel, kernel-devel, krb5, kubernetes, libmodplug, libsbc1, libvpx-devel, libxls-devel, mozilla-nss, mozillafirefox, openssh8.4, openssl-3, php8, python, python-base, python-doc, python-weasyprint, python311, python312, python313, python313-CairoSVG, python313-Django, python313-multidict, python313-sglang, python313-urllib3_1, python313-vllm, python314, python315, rabbitmq-server, rclone, rpcbind, squid, trivy, wpa_supplicant, xorg-x11-server, and xwayland).
lwn.net
October 26, 2026 at 2:22 PM
palohagara.bsky.social
dalšie kritické body/správci
-niektorých Mussk prepustil,DOGE "úspory" pár mil.=viac dlhov USA o miliardy

RUNK matem.výpočty (honiť si,po švédsky)👌🤭
+openSSL,SUDO admin,cURL všetka inet komunikácia
+Time,SQlite,JPEG+PNG,packer zlib+xz,bash shell, libXML dokumentov+mobilov..
bsky.app/profile/skid...
October 23, 2026 at 7:51 PM
michabbb.bsky.social
🔧 The scomp CLI generates classes with getters, setters and isSet/unset accessors straight from an XSD, so the schema stays the single source of truth. Install via #Composer, requires PHP >= 7.2 with ext-dom, ext-libxml, ext-simplexml and ext-bcmath
October 17, 2026 at 3:00 PM
bovine3dom.masto.ai.ap.brid.gy
@moof `less` if it's indented and huge, vim if it's indented and merely big. if it isn't indented, i use some binding to libxml in Julia to prod at it. but really i don't get on well with XML at all

https://github.com/bovine3dom/departures/blob/master/make_station_list/db/wrangler.jl

(iirc DB […]
Original post on masto.ai
masto.ai
September 25, 2026 at 11:27 PM
bagder.mastodon.social.ap.brid.gy
Welcome to minnnjuuu as #curl commit author 1535: https://github.com/curl/curl/pull/23008
examples: clean up crawler link parsing resources by minnnjuuu · Pull Request #23008 · curl/curl
What is the purpose of the change? follow_links() owns the libxml document returned by htmlReadMemory() and each xmlChar URL returned by xmlNodeListGetString() or xmlBuildURI(). The document was no...
github.com
September 21, 2026 at 6:18 AM
projektgopher.com
First, 3 corrections. 8.4.25 was a bug-fix release, not security (thanks Daniel Scherzer). The libxml-rs contributors we didn't name were James Gilliland and David Carlier — @timwolla.bsky.social noted every From header had a real name. And Džuris caught a read slip: Tim disagreed with Sjoerd.
September 10, 2026 at 6:03 AM
vanuatugis.bsky.social
ST_SummaryStats gives unknown values (infinity and different values) when clipping raster with buffer
I am loading a raster to postgis (see postgis version and command below) raster2pgsql /path_to_raster/temp-221025_12.tif -d icon_test -F -n name | PGPASSWORD= psql -d -h -U -p POSTGIS="3.1.2 cbe925d" [EXTENSION] PGSQL="120" GEOS="3.7.1-CAPI-1.11.1 27a5e771" PROJ="Rel. 4.9.3, 15 August 2016" GDAL="GDAL 2.1.2, released 2016/10/24" LIBXML="2.9.4" LIBJSON="0.12.1" LIBPROTOBUF="1.2.1" WAGYU="0.5.0 (Internal)" RASTER I am trying to get stats of pixels near a point with this query: SELECT name,ST_SummaryStats( ST_Clip(rast, ST_buffer(ST_GeomFromText('POINT(-90.37083 15.47083)',4326), 3000*0.00001)) ) from icon_test But it gives me BAD stats according to my knowledge (check columns in the image) I have loaded the tif to QGIS and overlaying the point buffer and it overlays to 4 pixels as the stats says but I was expecting mean as ((18.797+18.391+17.976+17.544)/4) = 18.177 and max=18.797 and min=17.544 (based on the image) Why ST_SummaryStats is not giving the expected stats ? Link to raster if you want to download UPDATE 1 using envelope works for this coord: SELECT name, (ST_SummaryStats( ST_Clip(rast, st_envelope(ST_buffer(ST_GeomFromText('POINT(-90.37083 15.47083)',4326), 3000*0.00001)) ) ) ).* from icon_test Result: name |count|sum |mean |stddev |min |max | ------------------+-----+-----------------+-----------------+------------------+------------------+------------------+ temp-221025_12.tif| 4|72.70815658569336|18.17703914642334|0.4666503646805367|17.544031143188477|18.797155380249023| Result for coord. POINT(-90.6 14.52): name |count|sum |mean |stddev |min |max | ------------------+-----+---------+---------+--------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------+ temp-221025_12.tif| 4|-Infinity|-Infinity|Infinity|-17976931348623157000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000|13.930984497070312| UPDATE 2 Raster STATS same with POSTGIS and cli-GDAL: count |sum |mean |stddev |min |max | ------+----------------+------------------+------------------+------------------+------------------+ 990525|23331638.4433757|23.554820366346835|5.6419397045642325|-4.649328708648682|31.385828018188477| UPDATE 3 pixel values of clip: select ST_PixelAsPoints( ST_CLIP(rast, ST_buffer(ST_GeomFromText('POINT (-90.37083 15.47083)',4326), 3000*0.00001)) ) geom from icon_test geom | ---------------------------------------------------------------------------------+ (0101000020E610000033333333339B56C0CCCCCCCCCC0C2F40,-1.7976931348623157e+308,1,1)| (0101000020E610000000000000009856C0CCCCCCCCCC0C2F40,-1.7976931348623157e+308,2,1)| (0101000020E610000033333333339B56C03233333333F32E40,-1.7976931348623157e+308,1,2)| (0101000020E610000000000000009856C03233333333F32E40,17.544031143188477,2,2) | UPDATE 4: I am unable to get this to work for all rasters, any other ideas?
gis.stackexchange.com
September 8, 2026 at 10:10 PM
projektgopher.com
Riaan de Beer has written libxml-rs, a native-Rust libxml2 that's C ABI compatible, and asked whether php-src would take a test build. Byte-identical xmllint and xmlcatalog across 1,110 tests.

The list answered his opening sentence instead: libxml2 isn't unmaintained.
September 3, 2026 at 1:52 AM
pyrox.dev
Like imagine if every tiny util had an author who was getting a few hundred bucks a month, that would be awesome. Especially folks maintaining critical libraries like libxml, various GNOME libraries, etc. Would be awesome for them to get money for their work.
August 27, 2026 at 3:48 AM
stackflag.bsky.social
CVE-2026-57074 - libxml-bare-perl
A bug in the XML::Bare Perl module for parsing XML data can cause it to read data beyond its expected limits. This can potentially allow malicious data to be accessed. To…

Too many irrelevant or confusing CVEs? Use stackflag.com

#debian #Debian11 #CVE #infosec
July 18, 2026 at 9:28 AM
handle.invalid
CVE-2025-1219: Critical PHP (libxml) vulnerability. Incorrect redirect handling bypasses validation in versions < 8.1.32, 8.2.28, 8.3.18, & 8.4.5. Update immediately.#PHPlibxmlVulnerability
March 31, 2025 at 8:18 AM
thehackerwire.bsky.social
🟠 CVE-2026-8177 - High (7.5)

XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node...

https://www.thehackerwire.com/vulnerability/CVE-2026-8177/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack
CVE-2026-8177 - High
May 11, 2026 at 6:59 PM
liotier.bsky.social
Why does XML::LibXML::Document's toString() give me a SCALAR instead of an #XML string ? <a href="http://stackoverflow.com/q/14954242/91034" class="hover:underline text-blue-600 dark:text-sky-400 no-card-link" target="_blank" rel="noopener" data-link="bsky">http://stackoverflow.com/q/14954242/91034 #Perl
Why does XML::LibXML::Document's toString() give me "SCAL...
Here is a code sample that reproduces the behaviour I won...
stackoverflow.com
November 18, 2024 at 10:00 AM
msw.bsky.social
Y'all, AI models seem to be *really good* at triaging vulnerabilities that are discovered with AI tooling!

Try this prompt:
> read gitlab.gnome.org/GNOME/libxml... and tell me if CVE-2026-6732 applies to github.com/libarchive/l...

[...]
Conclusion
Not affected.
The Vulnerability The libxml2 issue (GitLab work item #1097) is a type confusion in xmlParseReference() that occurs exclusively when streaming XSD schema validation is active. The bug passes ctxt (parser context) instead of ctxt->userData to SAX characters() / cdataBlock() callbacks. This only causes a crash when xmlSchemaSAXPlug has redirected those callbacks — meaning schema validation must be enabled on the reader/parser. How libarchive uses libxml2 libarchive uses libxml2 solely for parsing XAR archive table-of-contents XML in archive_read_support_format_xar.c. It uses the xmlTextReader pull-parsing API: - xmlTextReaderRead() - xmlTextReaderNodeType() - xmlTextReaderConstLocalName() - xmlTextReaderConstValue() - xmlTextReaderMoveToFirstAttribute() / MoveToNextAttribute() It does not call any schema validation functions: - No xmlTextReaderSchemaValidate() - No xmlSchemaSAXPlug() - No xmlSchemaValidateStream() - No xmlSchemaNewValidCtxt() Conclusion Not affected. The vulnerable code path requires XSD streaming validation to be plugged into the SAX layer. libarchive never enables schema validation — it just reads XML nodes from XAR TOC data. Without the schema validation SAX plug active, the type confusion in xmlParseReference() cannot be triggered, even if the XML being parsed contains entity references.
May 19, 2026 at 10:01 PM
msw.bsky.social
While there is much more that industry can do, and NEEDS to do, we should recognize that in the past Google has directly sponsored libxml2 development.

It's not *just* been Project Zero sending vulnerability disclosures to the maintainer.
gitlab.gnome.org/GNOME/libxml...
June 21, 2025 at 11:08 PM
andres4ny.social.ridetrans.it.ap.brid.gy
The libxml2 maintainer is basically shrugging his shoulders and saying "deal with your own fucking security issues; libxml was never meant to be used in your projects" to google and the rest of the giant corporations that are using his labor without contributing back. I'm totally on board with […]
Original post on social.ridetrans.it
social.ridetrans.it
June 17, 2025 at 5:06 PM
handle.invalid
I spent the whole day trying to figure out how to link a single C library until I found some random blog post saying I can do `lib.linkSystemLibrary2("libxml-2.0", .{ .use_pkg_config = .force });` and even then I had to remember pkg-config exists while searching for it
November 12, 2024 at 10:23 PM
ytjvdcm.mstdn.virtecam.net.ap.brid.gy
libxmlがないとかでUnityが起動しなくなったんですがこれは一体
May 5, 2025 at 8:56 AM
xwolf.de
@cjk101010 : Nach umschalten auf die LibXML-Bibliothek war es allerdings nicht schneller :/
January 4, 2025 at 1:52 AM
neustradamus.bsky.social
#libxml2 2.14.1 has been released ( #Xmlsoft / #libxml / #XML / #ExtensibleMarkupLanguage / #CVE / #SecurityVulnerability ) github.com/GNOME/libxml2
GitHub - GNOME/libxml2: Read-only mirror of https://gitlab.gnome.org/GNOME/libxml2
Read-only mirror of https://gitlab.gnome.org/GNOME/libxml2 - GNOME/libxml2
github.com
April 8, 2025 at 11:25 PM
chris.mstdn.chrisalemany.ca.ap.brid.gy
Any experienced Perl folks out there using XML::LibXML vs XML::Simple?

I'm trying to move to LibXML like a good modern xml munger.

I'm using the XML weather data file here: https://alberniweather.ca/ECXMLfileInland.xml

I've been getting the keys and entries from the XML file by loading it […]
Original post on mstdn.chrisalemany.ca
mstdn.chrisalemany.ca
December 16, 2025 at 9:28 PM