PT-2008-1032 · Xmlsoft+1 · Libxml2+1

Published 2008-01-11 · Updated 2024-06-15 · CVE-2007-6284

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.6.31 libxml2 versions 2.6.26 through 2.6.30

Description The issue allows context-dependent attackers to cause a denial of service via XML containing invalid UTF-8 sequences, potentially leading to disruption of protected information. This can be exploited remotely.

Recommendations For libxml2 versions prior to 2.6.31, update to version 2.6.31 or later to resolve the issue. For libxml2 versions 2.6.26 through 2.6.30, update to version 2.6.31 or later to resolve the issue. As a temporary workaround, consider restricting the use of the xmlCurrentChar function until a patch is available.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-02619

BDU:2015-07044

BDU:2015-07046

BDU:2015-09615

CVE-2007-6284

DSA-1461-1

OPENSUSE-SU-2024:11016-1

RHSA-2008:0032

RHSA-2008_0032

Affected Products

Red Hat

Libxml2

References · 74

• http://secunia.com/advisories/28439 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-January/msg00379.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-6284 · Vendor Advisory
• http://secunia.com/advisories/28452 · Vendor Advisory
• http://secunia.com/advisories/28475 · Vendor Advisory
• http://secunia.com/advisories/28450 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:010 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-6284 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-103201-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-6284 · Vendor Advisory
• http://secunia.com/advisories/28636 · Vendor Advisory
• http://secunia.com/advisories/28444 · Vendor Advisory
• http://secunia.com/advisories/28716 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07046 · Security Note
• http://security.gentoo.org/glsa/glsa-200801-20.xml · Vendor Advisory