PT-2008-1091 · Xmlsoft+1 · Libxml2+1

Andreas Solberg · Published 2008-08-21 · Updated 2024-02-02 · CVE-2008-3281

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libxml2 versions 2.6.32 and earlier

Description The issue allows context-dependent attackers to cause a denial of service, consuming memory and CPU, via a crafted XML document. This is due to improper detection of recursion during entity expansion in an attribute value. Multiple vulnerabilities in the libxml2 package can lead to breaches of confidentiality, integrity, and availability of protected information, and can be exploited remotely.

Recommendations For libxml2 versions 2.6.32 and earlier, update to a version later than 2.6.32 to resolve the issue. As a temporary workaround, consider restricting the processing of crafted XML documents to minimize the risk of exploitation.

Exploit

Fix

DoS

XML Entity Expansion

Weakness Enumeration

CWE-776

Related Identifiers

BDU:2015-09349

CVE-2008-3281

DSA-1631-1

DTSA-158-1

RHSA-2008:0836

RHSA-2008_0836

Affected Products

Red Hat

Libxml2

References · 50

• 🔥 http://mail.gnome.org/archives/xml/2008-August/msg00034.html · Exploit
• https://usn.ubuntu.com/644-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:192 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:180 · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2008-0836.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09349 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200812-06.xml · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00261.html · Vendor Advisory
• http://ubuntu.com/usn/usn-640-1 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00347.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html · Vendor Advisory
• http://debian.org/security/2008/dsa-1631 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3281 · Security Note
• https://osv.dev/vulnerability/CVE-2008-3281 · Vendor Advisory