CVE-2015-8710

Published: 11/04/2016 Updated: 26/02/2020

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

The htmlParseComment function in HTMLparser.c in libxml2 allows malicious users to obtain sensitive information, cause a denial of service (out-of-bounds heap memory access and application crash), or possibly have unspecified other impact via an unclosed HTML comment.

Vulnerable Product	Search on Vulmon	Subscribe to Product
xmlsoft libxml2
debian debian linux 8.0
debian debian linux 7.0
debian debian linux 9.0

Synopsis Moderate: libxml2 security update Type/Severity Security Advisory: Moderate Topic Updated libxml2 packages that fix multiple security issues are nowavailable for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having Moderate securityimpact Common Vulnerability Scoring ...

libxml2 could be made to crash if it opened a specially crafted file ...

Several vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially sensitive informatio ...

A denial of service flaw was found in libxml2 A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information(CVE-2015-8242) A denial of service flaw was found in libxml2 A remote attacker could provide a specially cr ...

It was discovered that libxml2 could access out-of-bounds memory when parsing unclosed HTML comments A remote attacker could provide a specially crafted XML file that, when processed by an application linked against libxml2, could cause the application to disclose heap memory contents ...

Windows/Linux reproducer

Reproducer Kudos to Mike Dalessio, Francois Chagnon, Florian Weingarten and Jun Kokatsu See BZ 746048 Building on Linux $ cmake /CVE-2015-8710/ -G "Unix Makefiles" -DLIBXML2_LIBRARIES=/path/to/your/library/libxml2so2 -DLIBXML2_INCLUDE_DIR=/path/to/your/sources/libxml2-291/include/ $ make Reproducing on Linux $ valgrind /

CWE-119 https://hackerone.com/reports/57125#activity-384861 http://www.debian.org/security/2015/dsa-3430 https://bugzilla.gnome.org/show_bug.cgi?id=746048 http://www.securityfocus.com/bid/79811 https://git.gnome.org/browse/libxml2/commit/?id=e724879d964d774df9b7969fc846605aa1bac54c http://www.openwall.com/lists/oss-security/2015/09/13/1 http://www.openwall.com/lists/oss-security/2015/04/19/4 http://www.openwall.com/lists/oss-security/2015/12/31/7 http://rhn.redhat.com/errata/RHSA-2016-1089.html https://access.redhat.com/errata/RHSA-2015:2550 https://nvd.nist.gov https://usn.ubuntu.com/2875-1/

CVE-2015-8710

Vulnerability Summary

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect