News for hackers. Stuff that matters.

A comment on Libxml2's "no security embargoes" policy. Parent comment

Re:Libxml2's "no security embargoes" policy by arp242 on Thursday June 26, 2025 @06:56AM (#44386120)
By that standard almost any bug could be considered a "security bug", including things like "returns error even though my XML is valid" or "it parses this data wrong".
[ Parent | on HN ]
Re:Libxml2's "no security embargoes" policy by me_jumper on Friday June 27, 2025 @03:28AM (#44394512)
Well, yes... Differentials in parsing of the same data can definitely lead to security vulnerabilities.

Just some random examples:

- https://www.ias.cs.tu-bs.de/publications/parsing_differentia... - https://www.ndss-symposium.org/ndss-paper/diffcsp-finding-br... - https://www.brainonfire.net/blog/2022/04/11/what-is-parser-m...

[ Parent | on HN ]