PT-2008-1093 · Xmlsoft+1 · Libxml2+1
Published
2008-11-17
·
Updated
2024-06-15
·
CVE-2008-4226
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
libxml2 versions prior to 2.7.2
Description
The issue is related to an integer overflow in the
xmlSAX2Characters function, which can be exploited by context-dependent attackers to cause a denial of service or possibly execute arbitrary code via a large XML document. Multiple vulnerabilities in the libxml2 package can lead to breaches of confidentiality, integrity, and availability of protected information, and can be exploited remotely.Recommendations
For libxml2 versions prior to 2.7.2, update to version 2.7.2 or later to resolve the issue. As a temporary workaround, consider restricting the size of XML documents processed by the
xmlSAX2Characters function to prevent potential exploitation.Fix
DoS
XML Entity Expansion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Red Hat
Libxml2