CVE-2011-1944 Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly...
HighCVSS 9.3
EPSS 13.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libxml2(Debian:12) | < 2.7.8.dfsg-3 | 2.7.8.dfsg-3 |
| debian/libxml2(Debian:13) | < 2.7.8.dfsg-3 | 2.7.8.dfsg-3 |
| debian/libxml2(Debian:14) | < 2.7.8.dfsg-3 | 2.7.8.dfsg-3 |
| xmlsoft libxml2 | = 2.6.0 | No fix listed |
| xmlsoft libxml2 | = 2.6.1 | No fix listed |
| xmlsoft libxml2 | = 2.6.2 | No fix listed |
| xmlsoft libxml2 | = 2.6.3 | No fix listed |
| xmlsoft libxml2 | = 2.6.4 | No fix listed |
| xmlsoft libxml2 | = 2.6.5 | No fix listed |
| xmlsoft libxml2 | = 2.6.6 | No fix listed |
| xmlsoft libxml2 | = 2.6.7 | No fix listed |
| xmlsoft libxml2 | = 2.6.8 | No fix listed |
| xmlsoft libxml2 | = 2.6.9 | No fix listed |
| xmlsoft libxml2 | = 2.6.11 | No fix listed |
| xmlsoft libxml2 | = 2.6.12 | No fix listed |
| xmlsoft libxml2 | = 2.6.13 | No fix listed |
| xmlsoft libxml2 | = 2.6.14 | No fix listed |
| xmlsoft libxml2 | = 2.6.16 | No fix listed |
| xmlsoft libxml2 | = 2.6.17 | No fix listed |
| xmlsoft libxml2 | = 2.6.18 | No fix listed |
| xmlsoft libxml2 | = 2.6.20 | No fix listed |
| xmlsoft libxml2 | = 2.6.22 | No fix listed |
| xmlsoft libxml2 | = 2.6.26 | No fix listed |
| xmlsoft libxml2 | = 2.6.27 | No fix listed |
| xmlsoft libxml2 | = 2.6.30 | No fix listed |
Show 36 more
| Product | Affected versions | Fixed in |
|---|---|---|
| xmlsoft libxml2 | = 2.6.32 | No fix listed |
| xmlsoft libxml2 | = 2.7.0 | No fix listed |
| xmlsoft libxml2 | = 2.7.1 | No fix listed |
| xmlsoft libxml2 | = 2.7.2 | No fix listed |
| xmlsoft libxml2 | = 2.7.3 | No fix listed |
| xmlsoft libxml2 | = 2.7.4 | No fix listed |
| xmlsoft libxml2 | = 2.7.5 | No fix listed |
| xmlsoft libxml2 | = 2.7.6 | No fix listed |
| xmlsoft libxml2 | = 2.7.7 | No fix listed |
| xmlsoft libxml2 | = 2.7.8 | No fix listed |
| xmlsoft libxml | <= 1.8.16 | No fix listed |
| xmlsoft libxml | = 1.5.0 | No fix listed |
| xmlsoft libxml | = 1.6.0 | No fix listed |
| xmlsoft libxml | = 1.6.1 | No fix listed |
| xmlsoft libxml | = 1.6.2 | No fix listed |
| xmlsoft libxml | = 1.7.0 | No fix listed |
| xmlsoft libxml | = 1.7.1 | No fix listed |
| xmlsoft libxml | = 1.7.2 | No fix listed |
| xmlsoft libxml | = 1.7.3 | No fix listed |
| xmlsoft libxml | = 1.7.4 | No fix listed |
| xmlsoft libxml | = 1.8.0 | No fix listed |
| xmlsoft libxml | = 1.8.1 | No fix listed |
| xmlsoft libxml | = 1.8.2 | No fix listed |
| xmlsoft libxml | = 1.8.3 | No fix listed |
| xmlsoft libxml | = 1.8.4 | No fix listed |
| xmlsoft libxml | = 1.8.5 | No fix listed |
| xmlsoft libxml | = 1.8.6 | No fix listed |
| xmlsoft libxml | = 1.8.7 | No fix listed |
| xmlsoft libxml | = 1.8.8 | No fix listed |
| xmlsoft libxml | = 1.8.9 | No fix listed |
| xmlsoft libxml | = 1.8.10 | No fix listed |
| xmlsoft libxml | = 1.8.11 | No fix listed |
| xmlsoft libxml | = 1.8.12 | No fix listed |
| xmlsoft libxml | = 1.8.13 | No fix listed |
| xmlsoft libxml | = 1.8.14 | No fix listed |
| xmlsoft libxml | = 1.8.15 | No fix listed |
References
- Debian Security Tracker CVE-2011-1944 vendor-advisory
- bugs.debian.org issue-tracking
- git.gnome.org patch
- HPSBMU02786 vendor-advisory
- APPLE-SA-2012-05-09-1 vendor-advisory
- APPLE-SA-2012-09-19-1 vendor-advisory
- FEDORA-2011-7856 exploit patch vendor-advisory
- openSUSE-SU-2011:0839 vendor-advisory
- RHSA-2013:0217 vendor-advisory
- scarybeastsecurity.blogspot.com patch vendor-advisory
- 44711 third-party-advisory vendor-advisory
- support.apple.com
- support.apple.com
- USN-1153-1 vendor-advisory
- DSA-2255 vendor-advisory
- MDVSA-2011:131 vendor-advisory
- [oss-security] 20110531 Re: CVE request: libxml vulnerability and interesting integer issues exploit mailing-list patch
- www.oracle.com
- 73248 vdb-entry
- RHSA-2011:1749 vendor-advisory
- 48056 exploit vdb-entry
- bugzilla.redhat.com exploit patch