CVE-2004-0110 Buffer overflow in the (1) nanohttp or (2) nanoftp modules in XMLSoft Libxml 2 (Libxml2) 2.6.0 through 2.6.5 allow remote attackers to execute arbitrary code via a long URL.
HighCVSS 7.5
EPSS 24.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in the (1) nanohttp or (2) nanoftp modules in XMLSoft Libxml 2 (Libxml2) 2.6.0 through 2.6.5 allow remote attackers to execute arbitrary code via a long URL.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sgi propack | = 2.3 | No fix listed |
| sgi propack | = 2.4 | No fix listed |
| xmlsoft libxml | = 1.8.17 | No fix listed |
| xmlsoft libxml2 | = 2.4.19 | No fix listed |
| xmlsoft libxml2 | = 2.4.23 | No fix listed |
| xmlsoft libxml2 | = 2.5.4 | No fix listed |
| xmlsoft libxml2 | = 2.5.10 | No fix listed |
| xmlsoft libxml2 | = 2.5.11 | No fix listed |
| xmlsoft libxml2 | = 2.6.0 | No fix listed |
| xmlsoft libxml2 | = 2.6.1 | No fix listed |
| xmlsoft libxml2 | = 2.6.2 | No fix listed |
| xmlsoft libxml2 | = 2.6.3 | No fix listed |
| xmlsoft libxml2 | = 2.6.4 | No fix listed |
| xmlsoft libxml2 | = 2.6.5 | No fix listed |
| debian/libxml2(Debian:12) | < 2.6.6-1 | 2.6.6-1 |
| debian/libxml2(Debian:13) | < 2.6.6-1 | 2.6.6-1 |
| debian/libxml2(Debian:14) | < 2.6.6-1 | 2.6.6-1 |
References
- Debian Security Tracker CVE-2004-0110 vendor-advisory
- 20040305 [OpenPKG-SA-2004.003] OpenPKG Security Advisory (libxml) mailing-list
- 20040306 TSLSA-2004-0010 - libxml2 mailing-list
- RHSA-2004:090 patch vendor-advisory
- 10958 third-party-advisory
- GLSA-200403-01 vendor-advisory
- O-086 government-resource third-party-advisory
- DSA-455 vendor-advisory
- VU#493966 third-party-advisory us-government-resource
- SUSE-SR:2005:001 vendor-advisory
- RHSA-2004:091 vendor-advisory
- RHSA-2004:650 vendor-advisory
- 9718 patch vdb-entry vendor-advisory
- www.xmlsoft.org
- libxml2-nanohttp-bo(15301) vdb-entry
- libxml2-nanoftp-bo(15302) vdb-entry
- oval:org.mitre.oval:def:11626 signature vdb-entry
- oval:org.mitre.oval:def:833 signature vdb-entry
- oval:org.mitre.oval:def:875 signature vdb-entry