CVE-2008-3529 Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code...
HighCVSS 10.0
EPSS 23.4%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a long XML entity name.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xmlsoft libxml2 | < 2.7.0 | 2.7.0 |
| debian linux | = 4.0 | No fix listed |
| Canonical Ubuntu Linux | = 6.06 | No fix listed |
| Canonical Ubuntu Linux | = 7.04 | No fix listed |
| Canonical Ubuntu Linux | = 7.10 | No fix listed |
| Canonical Ubuntu Linux | = 8.04 | No fix listed |
| Canonical Ubuntu Linux | = 8.10 | No fix listed |
| Canonical Ubuntu Linux | = 9.04 | No fix listed |
| apple Safari | < 4.0 | 4.0 |
| apple Safari | >= 3.2.0, < 3.2.3 | 3.2.3 |
| apple iphone os | < 3.0 | 3.0 |
| apple mac os x | < 10.5.7 | 10.5.7 |
| apple mac os x | = 10.5.7 | No fix listed |
| debian/libxml2(Debian:12) | < 2.6.32.dfsg-4 | 2.6.32.dfsg-4 |
| debian/libxml2(Debian:13) | < 2.6.32.dfsg-4 | 2.6.32.dfsg-4 |
| debian/libxml2(Debian:14) | < 2.6.32.dfsg-4 | 2.6.32.dfsg-4 |
References
- APPLE-SA-2009-06-17-1 mailing-list third-party-advisory vendor-advisory
- APPLE-SA-2009-05-12 mailing-list third-party-advisory vendor-advisory
- APPLE-SA-2009-06-08-1 broken-link mailing-list vendor-advisory
- SUSE-SR:2008:018 mailing-list third-party-advisory vendor-advisory
- 31558 third-party-advisory
- 31855 third-party-advisory
- 31860 third-party-advisory
- 31868 third-party-advisory
- 31982 third-party-advisory
- 32265 third-party-advisory
- 32280 third-party-advisory
- 32807 third-party-advisory
- 32974 third-party-advisory
- 33715 third-party-advisory
- 33722 third-party-advisory
- 35056 third-party-advisory
- 35074 third-party-advisory
- 35379 third-party-advisory
- 36173 third-party-advisory
- 36235 third-party-advisory
- GLSA-200812-06 third-party-advisory vendor-advisory
- 1020855 third-party-advisory vdb-entry
- sunsolve.sun.com broken-link
- sunsolve.sun.com broken-link
- 247346 broken-link vendor-advisory
- 261688 broken-link vendor-advisory
- 265329 broken-link vendor-advisory
- support.apple.com third-party-advisory
- support.apple.com third-party-advisory
- support.apple.com third-party-advisory
- support.apple.com third-party-advisory
- support.avaya.com third-party-advisory
- support.avaya.com third-party-advisory
- wiki.rpath.com broken-link
- DSA-1654 third-party-advisory vendor-advisory
- MDVSA-2008:192 broken-link vendor-advisory
- RHSA-2008:0884 third-party-advisory vendor-advisory
- RHSA-2008:0886 third-party-advisory vendor-advisory
- 31126 third-party-advisory vdb-entry
- USN-815-1 third-party-advisory vendor-advisory
- TA09-133A third-party-advisory us-government-resource
- ADV-2008-2822 third-party-advisory vdb-entry
- ADV-2009-1297 third-party-advisory vdb-entry
- ADV-2009-1298 third-party-advisory vdb-entry
- ADV-2009-1522 third-party-advisory vdb-entry
- ADV-2009-1621 third-party-advisory vdb-entry
- xmlsoft.org release-notes vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- libxml2-entitynames-bo(45085) third-party-advisory vdb-entry
- oval:org.mitre.oval:def:11760 signature third-party-advisory vdb-entry
- oval:org.mitre.oval:def:6103 signature third-party-advisory vdb-entry
- USN-644-1 third-party-advisory vendor-advisory
- 8798 exploit third-party-advisory vdb-entry
- Debian Security Tracker CVE-2008-3529 vendor-advisory
- bugs.debian.org issue-tracking