PT-2008-1063 · Xmlsoft+1 · Libxml2+1
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
libxml2 versions prior to 2.7.0
libxml2 versions prior to 2.7.2
Description
The issue is related to a heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2, which allows context-dependent attackers to cause a denial of service or execute arbitrary code via a long XML entity name. Multiple vulnerabilities in the libxml2 package may lead to a violation of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely.
Recommendations
For libxml2 versions prior to 2.7.0, update to version 2.7.0 or later.
For libxml2 versions prior to 2.7.2, update to version 2.7.2 or later.
As a temporary workaround, consider restricting access to the xmlParseAttValueComplex function in parser.c until a patch is available.
Exploit
Correção
DoS
Buffer Overflow
XML Entity Expansion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Red Hat
Libxml2