libxmljs Segmentation Fault Vulnerability in XML Parsing Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in libxmljs version 1.0.11. When the library parses a specially crafted XML document, accessing the internal _ref property on entity_ref and entity_decl nodes leads to a segmentation fault. This issue crashes the application and could potentially allow for data leakage if further memory corruption can be achieved.

Impact

Exploitation of this vulnerability causes a segmentation fault, crashing the application. There is also a potential for data leakage if it leads to further memory corruption.

Reproduction

The vulnerability can be reproduced by creating a JavaScript file that requires the libxmljs library and parses an XML document containing a DOCTYPE declaration with an entity reference. After parsing the document, the _ref property can be accessed on the entity_ref or entity_decl nodes, which will cause a segmentation fault and crash the application.