Published: 27/08/2008 Updated: 02/02/2024

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

libxml2 2.6.32 and previous versions does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent malicious users to cause a denial of service (memory and CPU consumption) via a crafted XML document.

Vulnerable Product	Search on Vulmon	Subscribe to Product
xmlsoft libxml2
apple safari
apple iphone os
fedoraproject fedora 9
canonical ubuntu linux 7.04
canonical ubuntu linux 7.10
canonical ubuntu linux 8.04
canonical ubuntu linux 6.06
debian debian linux 4.0
redhat enterprise linux server 5.0
redhat enterprise linux desktop 3.0
redhat enterprise linux workstation 5.0
redhat enterprise linux desktop 4.0
redhat enterprise linux desktop 5.0
redhat enterprise linux eus 4.7
redhat enterprise linux server 4.0
redhat enterprise linux workstation 4.0
redhat enterprise linux workstation 3.0
redhat enterprise linux server 3.0
redhat enterprise linux eus 5.2
redhat enterprise linux server 2.0
redhat enterprise linux workstation 2.0
vmware esx 2.5.4
vmware esx 3.0.2
vmware esx 2.5.5
vmware esx 3.0.3

It was discovered that libxml2 did not correctly handle long entity names If a user were tricked into processing a specially crafted XML document, a remote attacker could execute arbitrary code with user privileges or cause the application linked against libxml2 to crash, leading to a denial of service (CVE-2008-3529) ...

Andreas Solberg discovered that libxml2 did not handle recursive entities safely If an application linked against libxml2 were made to process a specially crafted XML document, a remote attacker could exhaust the system’s CPU resources, leading to a denial of service ...

Andreas Solberg discovered that libxml2, the GNOME XML library, could be forced to recursively evaluate entities, until available CPU and memory resources were exhausted For the stable distribution (etch), this problem has been fixed in version 2627dfsg-4 For the unstable distribution (sid), this problem has been fixed in version 2632dfsg-3 ...

CWE-776 http://mail.gnome.org/archives/xml/2008-August/msg00034.html https://bugzilla.redhat.com/show_bug.cgi?id=458086 http://www.mandriva.com/security/advisories?name=MDVSA-2008:180 https://rhn.redhat.com/errata/RHSA-2008-0836.html http://www.securityfocus.com/bid/30783 http://www.ubuntu.com/usn/usn-640-1 http://secunia.com/advisories/31728 http://svn.gnome.org/viewvc/libxml2?view=revision&revision=3772 https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00261.html http://xmlsoft.org/news.html http://secunia.com/advisories/31558 http://secunia.com/advisories/31748 https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00347.html http://secunia.com/advisories/31590 http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html http://secunia.com/advisories/31855 http://www.mandriva.com/security/advisories?name=MDVSA-2008:192 http://www.vmware.com/security/advisories/VMSA-2008-0017.html http://lists.vmware.com/pipermail/security-announce/2008/000039.html http://secunia.com/advisories/32488 http://secunia.com/advisories/31566 http://www.securitytracker.com/id?1020728 http://www.debian.org/security/2008/dsa-1631 http://secunia.com/advisories/32807 http://wiki.rpath.com/Advisories:rPSA-2008-0325 http://security.gentoo.org/glsa/glsa-200812-06.xml http://secunia.com/advisories/32974 http://secunia.com/advisories/31982 http://www.vupen.com/english/advisories/2009/1522 http://secunia.com/advisories/35379 http://support.apple.com/kb/HT3613 http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html http://www.vupen.com/english/advisories/2009/1621 http://support.apple.com/kb/HT3639 http://www.vupen.com/english/advisories/2008/2843 http://www.vupen.com/english/advisories/2008/2971 http://www.vupen.com/english/advisories/2008/2419 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9812 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6496 https://usn.ubuntu.com/644-1/http://www.securityfocus.com/archive/1/497962/100/0/threaded https://usn.ubuntu.com/644-1/https://nvd.nist.gov

CVE-2008-3281

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect