PT-2008-1092 · Xmlsoft+1 · Libxml2+1

Drew Yao · Published 2008-11-17 · Updated 2024-06-15 · CVE-2008-4225

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.7.2

Description The issue is related to an integer overflow in the xmlBufferResize function, which allows context-dependent attackers to cause a denial of service, potentially leading to an infinite loop, via a large XML document. Additionally, there are multiple vulnerabilities in libxml2 that can lead to breaches of confidentiality, integrity, and availability of protected information, and these can be exploited remotely.

Recommendations For libxml2 versions prior to 2.7.2, update to version 2.7.2 or later to resolve the issue. As a temporary workaround, consider restricting the size of XML documents processed by the xmlBufferResize function to prevent potential denial of service attacks.

Fix

DoS

XML Entity Expansion

Weakness Enumeration

CWE-189

CWE-776

Related Identifiers

BDU:2015-09349

CVE-2008-4225

DSA-1666-1

OPENSUSE-SU-2024:10192-1

OPENSUSE-SU-2024:10228-1

RHSA-2008:0988

RHSA-2008_0988

Affected Products

Red Hat

Libxml2

References · 93

• http://secunia.com/advisories/32802 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0988.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-November/msg00513.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10192-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4225 · Security Note
• http://secunia.com/advisories/32773 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html · Vendor Advisory
• https://admin.fedoraproject.org/updates/libxml2-2.7.2-2.fc9 · Patch
• https://bdu.fstec.ru/vul/2015-09349 · Security Note
• http://secunia.com/advisories/32766 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:231 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-November/msg00472.html · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-251406-1 · Vendor Advisory
• http://secunia.com/advisories/32764 · Patch