Sicherheitslücken in raptor2

Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag

Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.

CVE-2024-57823

In Raptor RDF Syntax Library through 2.0.16, there is an integer underflow when normalizing a URI with the turtle parser in raptor_uri_normalize_path().

• Auf 2.0.15-4+deb12u1 aktualisieren

CVE-2024-57822

In Raptor RDF Syntax Library through 2.0.16, there is a heap-based buffer over-read when parsing triples with the nquads parser in raptor_ntriples_parse_term_internal().

• Auf 2.0.15-4+deb12u1 aktualisieren

CVE-2020-25713

A malformed input file can lead to a segfault due to an out of bounds array access in raptor_xml_writer_start_element_common.

• Auf 2.0.14-1.2 aktualisieren

CVE-2017-18926

raptor_xml_writer_start_element_common in raptor_xml_writer.c in Raptor RDF Syntax Library 2.0.15 miscalculates the maximum nspace declarations for the XML writer, leading to heap-based buffer overflows (sometimes seen in raptor_qname_format_as_xml).

• Auf 2.0.14-1.1 aktualisieren