PT-2008-1092 · Xmlsoft+1 · Libxml2+1
Drew Yao
·
Publicado
2008-11-17
·
Atualizado
2024-06-15
·
CVE-2008-4225
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
libxml2 versions prior to 2.7.2
Description
The issue is related to an integer overflow in the xmlBufferResize function, which allows context-dependent attackers to cause a denial of service, potentially leading to an infinite loop, via a large XML document. Additionally, there are multiple vulnerabilities in libxml2 that can lead to breaches of confidentiality, integrity, and availability of protected information, and these can be exploited remotely.
Recommendations
For libxml2 versions prior to 2.7.2, update to version 2.7.2 or later to resolve the issue. As a temporary workaround, consider restricting the size of XML documents processed by the xmlBufferResize function to prevent potential denial of service attacks.
Correção
DoS
XML Entity Expansion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Red Hat
Libxml2