Sparkjoy · Nokogiri · CVE-2015-8806
**Name of the Vulnerable Software and Affected Versions**
libxml2 (affected versions not specified)
Nokogiri (affected versions not specified)
**Description**
The issue is caused by a buffer overflow in the dict.c function of the libxml2 library. This can be exploited by a remote attacker to cause a denial of service, resulting in the application crashing. The exploitation can occur when a specially crafted HTML document containing an unexpected character after the "<!DOCTYPE html" substring is processed. It was also discovered that libxml2 and libxslt, which Nokogiri depends on, incorrectly handle certain malformed documents, potentially allowing malicious users to cause issues ranging from denial of service to remote code execution attacks.
**Recommendations**
For libxml2, consider disabling the dict.c function as a temporary workaround until a patch is available.
For Nokogiri, restrict the use of libxml2 and libxslt libraries to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.