PT-2015-2751 · Libxml2+6 · Libxml2+6

Michal Zalewski · Published 2015-10-23 · Updated 2026-03-13 · CVE-2015-7941

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions libxml2 version 2.9.2

Description The issue is caused by improper handling of invalid input, allowing context-dependent attackers to cause a denial of service via crafted XML data. This can lead to an out-of-bounds read and a crash in libxml2. The xmlParseEntityDecl and xmlParseConditionalSections functions in parser.c are affected.

Recommendations For libxml2 version 2.9.2, consider updating to a newer version to resolve the issue. As a temporary workaround, restrict the use of the xmlParseEntityDecl and xmlParseConditionalSections functions in parser.c to minimize the risk of exploitation. Avoid using crafted XML data that could trigger the denial of service.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2015-2016

BDU:2015-12116

CESA-2015_2549

CESA-2015_2550

CVE-2015-7941

DLA-266-1

DSA-3430-1

OPENSUSE-SU-2024:10192-1

OPENSUSE-SU-2024:10549-1

OPENSUSE-SU-2024:11340-1

OPENSUSE-SU-2024:11912-1

OPENSUSE-SU-2024:13165-1

OPENSUSE-SU-2024:14174-1

OPENSUSE-SU-2025:14697-1

OPENSUSE-SU-2026:10356-1

RHSA-2015:2549

RHSA-2015:2550

RHSA-2015_2549

RHSA-2015_2550

SUSE-SU-2016:0030-1

SUSE-SU-2016:0049-1

SUSE-SU-2016:0786-1

USN-2812-1

Affected Products

Alt Linux

Centos

Ibm Aix

Red Hat

Suse

Ubuntu

Libxml2

References · 128

• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177341.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8035 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14174-1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177381.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-7941 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14697-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html · Vendor Advisory
• https://security.gentoo.org/glsa/201701-37 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-12116 · Security Note
• https://ubuntu.com/security/CVE-2015-7942 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-7941 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3430-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-7941 · Vendor Advisory
• http://debian.org/security/2015/dsa-3430 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2015-2549.html · Vendor Advisory