PT-2009-1016 · Xmlsoft+2 · Libxml+3
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
libxml2 versions 2.5.10 through 2.6.32
libxml version 1.8.17
Description
The issue allows context-dependent attackers to cause a denial of service, resulting in an application crash, via crafted Notation or Enumeration attribute types in an XML file. This can be exploited remotely. The vulnerability is related to use-after-free errors and buffer data boundary issues.
Recommendations
For libxml2 versions 2.5.10 through 2.6.32, update to a version newer than 2.7.3-r2 to resolve the issue.
For libxml version 1.8.17, consider disabling the use of Notation or Enumeration attribute types in XML files until a patch is available.
Restrict access to XML files to minimize the risk of exploitation.
Exploit
Fix
DoS
Use After Free
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Red Hat
Vmware Vcenter
Libxml
Libxml2