CVE-2015-5312 Nokogiri subject to DoS via libxml2 vulnerability
HighCVSS 7.1
EPSS 4.5%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems nokogiri(RubyGems) | >= 1.6.0, <= 1.6.7.0 | No fix listed |
| rubygems nokogiri(RubyGems) | >= 1.6.0, < 1.6.7.1 | 1.6.7.1 |
| rubygems nokogiri(RubyGems) | = 1.6.0 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.2.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.2.rc1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.2.rc2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.2.rc3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.3.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.3.rc1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.3.rc2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.3.rc3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.4 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.4.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.5 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.6.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.6.2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.6.3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.6.4 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.7 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.7.rc2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.7.rc3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.7.rc4 | No fix listed |
Show 20 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libxml2(Debian:12) | < 2.9.3+dfsg1-1 | 2.9.3+dfsg1-1 |
| debian/libxml2(Debian:13) | < 2.9.3+dfsg1-1 | 2.9.3+dfsg1-1 |
| debian/libxml2(Debian:14) | < 2.9.3+dfsg1-1 | 2.9.3+dfsg1-1 |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.10 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux hpc node | = 6.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| apple iphone os | <= 9.2.1 | No fix listed |
| apple mac os x | <= 10.11.3 | No fix listed |
| apple tvOS | <= 9.1 | No fix listed |
| apple watchOS | <= 2.1 | No fix listed |
| xmlsoft libxml2 | <= 2.9.2 | No fix listed |
| HP Inc icewall federation agent | = 3.0 | No fix listed |
| HP Inc icewall file manager | = 3.0 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking
- git.gnome.org
- h20566.www2.hpe.com third-party-advisory
- GLSA-201701-37 vendor-advisory
- support.apple.com vendor-advisory
- support.apple.com vendor-advisory
- support.apple.com vendor-advisory
- support.apple.com vendor-advisory
- APPLE-SA-2016-03-21-1 vendor-advisory
- openSUSE-SU-2015:2372 vendor-advisory
- openSUSE-SU-2016:0106 vendor-advisory
- HPSBGN03537 third-party-advisory vendor-advisory
- RHSA-2015:2549 third-party-advisory vendor-advisory
- RHSA-2015:2550 third-party-advisory vendor-advisory
- DSA-3430 third-party-advisory vendor-advisory
- www.oracle.com
- www.oracle.com
- USN-2834-1 third-party-advisory vendor-advisory
- xmlsoft.org vendor-advisory
- github.com exploit
- groups.google.com
- github.com
- Debian Security Tracker CVE-2015-5312 vendor-advisory
- APPLE-SA-2016-03-21-2 vendor-advisory
- APPLE-SA-2016-03-21-3 third-party-advisory vendor-advisory
- APPLE-SA-2016-03-21-5 mailing-list vendor-advisory
- RHSA-2016:1089 vendor-advisory
- 79536 vdb-entry
- 1034243 vdb-entry