Nokogiri gem contains several vulnerabilities in libxml2 and libxslt

Description

Several vulnerabilities were discovered in the libxml2 and libxslt libraries
that the Nokogiri gem depends on.

CVE-2015-1819
A denial of service flaw was found in the way libxml2 parsed XML
documents. This flaw could cause an application that uses libxml2 to use an
excessive amount of memory.

CVE-2015-7941
libxml2 does not properly stop parsing invalid input, which allows
context-dependent attackers to cause a denial of service (out-of-bounds read
and libxml2 crash) via crafted specially XML data.

CVE-2015-7942
The xmlParseConditionalSections function in parser.c in libxml2
does not properly skip intermediary entities when it stops parsing invalid
input, which allows context-dependent attackers to cause a denial of service
(out-of-bounds read and crash) via crafted XML data.

CVE-2015-7995
The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not
check whether the parent node is an element, which allows attackers to cause
a denial of service using a specially crafted XML document.

CVE-2015-8035
The xz_decomp function in xzlib.c in libxml2 2.9.1 does not
properly detect compression errors, which allows context-dependent attackers
to cause a denial of service (process hang) via crafted XML data.

Another vulnerability was discoverd in libxml2 that could cause parsing
of unclosed comments to result in "conditional jump or move depends on
uninitialized value(s)" and unsafe memory access. This issue does not have a
CVE assigned yet. See related URLs for details. Patched in v1.6.7.rc4.

Am I vulnerable?

The constraints below list the versions that this vulnerability is patched in, and versions that are unaffected. If a patch is ready but unrealeased, then it is pending.

Or, you can just let us figure it out for you! Appcanary continously monitor your installed packages, and tell you if any of them are vulnerable.

Sign up for monitoring

Affected package information

Package Patched in Unaffected in
nokogiri ~> 1.6.6.4,>= 1.6.7.rc4 None