Published: 15/12/2015 Updated: 14/09/2017

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 446

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

The xmlParseXMLDecl function in parser.c in libxml2 prior to 2.9.3 allows context-dependent malicious users to obtain sensitive information via an (1) unterminated encoding value or (2) incomplete XML declaration in XML data, which triggers an out-of-bounds heap read.

Vulnerable Product	Search on Vulmon	Subscribe to Product
debian debian linux 8.0
debian debian linux 7.0
canonical ubuntu linux 15.04
canonical ubuntu linux 15.10
canonical ubuntu linux 12.04
canonical ubuntu linux 14.04
xmlsoft libxml2
redhat enterprise linux hpc node 6.0
redhat enterprise linux server 6.0
redhat enterprise linux desktop 6.0
redhat enterprise linux workstation 6.0
hp icewall federation agent 3.0
hp icewall file manager 3.0

libxml2 could be made to crash if it opened a specially crafted file ...

Synopsis Moderate: libxml2 security update Type/Severity Security Advisory: Moderate Topic Updated libxml2 packages that fix multiple security issues are nowavailable for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having Moderate securityimpact Common Vulnerability Scoring ...

Synopsis Moderate: libxml2 security update Type/Severity Security Advisory: Moderate Topic Updated libxml2 packages that fix multiple security issues are nowavailable for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having Moderate securityimpact Common Vulnerability Scoring ...

Several vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially sensitive informatio ...

Debian Bug report logs - #806384 libxml2: CVE-2015-8241: Buffer overread with XML parser in xmlNextChar Package: src:libxml2; Maintainer for src:libxml2 is Debian XML/SGML Group <debian-xml-sgml-pkgs@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 26 Nov 2015 20:48:01 UTC Se ...

Debian Bug report logs - #802827 libxml2: CVE-2015-7942: heap-buffer-overflow in xmlParseConditionalSections Package: src:libxml2; Maintainer for src:libxml2 is Debian XML/SGML Group <debian-xml-sgml-pkgs@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 23 Oct 2015 20:51:01 UT ...

Debian Bug report logs - #803942 CVE-2015-8035: DoS with XZ compression support loop Package: libxml2; Maintainer for libxml2 is Debian XML/SGML Group <debian-xml-sgml-pkgs@listsaliothdebianorg>; Source for libxml2 is src:libxml2 (PTS, buildd, popcon) Reported by: Raphael Hertzog <hertzog@debianorg> Date: Tue, 3 ...

Debian Bug report logs - #782782 libxml2: CVE-2015-1819: denial of service processing a crafted XML document Package: src:libxml2; Maintainer for src:libxml2 is Debian XML/SGML Group <debian-xml-sgml-pkgs@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 17 Apr 2015 19:39:02 UT ...

Debian Bug report logs - #782985 libxml2: parsing an unclosed comment can result in `Conditional jump or move depends on uninitialised value(s)` and unsafe memory access Package: src:libxml2; Maintainer for src:libxml2 is Debian XML/SGML Group <debian-xml-sgml-pkgs@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso & ...

Debian Bug report logs - #783010 libxml2: out-of-bounds read Package: src:libxml2; Maintainer for src:libxml2 is Debian XML/SGML Group <debian-xml-sgml-pkgs@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 20 Apr 2015 15:27:02 UTC Severity: normal Tags: fixed-upstream, jessie ...

A denial of service flaw was found in libxml2 A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information(CVE-2015-8242) A denial of service flaw was found in libxml2 A remote attacker could provide a specially cr ...

A denial of service flaw was found in the way the libxml2 library parsed certain XML files An attacker could provide a specially crafted XML file that, when parsed by an application using libxml2, could cause that application to use an excessive amount of memory The xmlParseConditionalSections function in parserc in libxml2 does not properly ski ...

2nd Assignment of Software Engineering Course in UNIST

Assignment 2 Introduction In this assignment, you will use a fuzzing tool called AFL++ which is a community-maintained fork of the original fuzzing tool called AFL Since there is no fundamental difference between AFL++ and AFL, we will refer to AFL++ just as AFL Part 1 will help you set up your environment Part 2 will guide you through a demo where you will fuzz a dummy libr

Repository containing files for Assignment 2 on Software Engineering course. UNIST Spring 2022.

CWE-119 http://rhn.redhat.com/errata/RHSA-2015-2549.html http://www.openwall.com/lists/oss-security/2015/11/21/1 https://git.gnome.org/browse/libxml2/commit/?id=709a952110e98621c9b78c4f26462a9d8333102e https://git.gnome.org/browse/libxml2/commit/?id=9aa37588ee78a06ca1379a9d9356eab16686099c https://bugzilla.gnome.org/show_bug.cgi?id=751603 http://www.openwall.com/lists/oss-security/2015/11/22/3 https://blog.fuzzing-project.org/28-Libxml2-Several-out-of-bounds-reads.html http://www.ubuntu.com/usn/USN-2834-1 https://bugzilla.gnome.org/show_bug.cgi?id=751631 https://bugzilla.redhat.com/show_bug.cgi?id=1281930 http://www.debian.org/security/2015/dsa-3430 http://marc.info/?l=bugtraq&m=145382616617563&w=2 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944172 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html http://www.securityfocus.com/bid/77681 http://rhn.redhat.com/errata/RHSA-2016-1089.html http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html https://support.apple.com/HT206905 https://support.apple.com/HT206904 https://support.apple.com/HT206903 https://support.apple.com/HT206902 https://support.apple.com/HT206901 https://support.apple.com/HT206899 http://www.securityfocus.com/bid/91826 http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html http://www.securitytracker.com/id/1034243 https://usn.ubuntu.com/2834-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2015-8317

Get Started

CVE-2015-8317

Vulnerability Summary

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect