CVE-2004-0989

Published: Mar 1, 2005Modified: Apr 16, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Multiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other versions, may allow remote attackers to execute arbitrary code via (1) a long FTP URL that is not properly handled by the xmlNanoFTPScanURL function, (2) a long proxy URL containing FTP data that is not properly handled by the xmlNanoFTPScanProxy function, and other overflows related to manipulation of DNS length values, including (3) xmlNanoFTPConnect, (4) xmlNanoHTTPConnectHost, and (5) xmlNanoHTTPConnectHost.

Affected (16)

Products: Xmlsoft: Libxml, Libxml2 · Xmlstarlet: Command Line Xml Toolkit · Redhat: Fedora Core · +2 more

Show all products

Xmlsoft: Libxml, Libxml2 · Xmlstarlet: Command Line Xml Toolkit · Redhat: Fedora Core · Trustix: Secure Linux · Ubuntu: Ubuntu Linux

2 products

1 product

Command Line Xml Toolkit

1 product

1 product

1 product

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Xmlsoft Libxml	Version 1.8.17
Xmlsoft Libxml2	Version 2.5.11
Xmlsoft Libxml2	Version 2.6.11
Xmlsoft Libxml2	Version 2.6.12
Xmlsoft Libxml2	Version 2.6.13
Xmlsoft Libxml2	Version 2.6.14
Xmlsoft Libxml2	Version 2.6.6
Xmlsoft Libxml2	Version 2.6.7
Xmlsoft Libxml2	Version 2.6.8
Xmlsoft Libxml2	Version 2.6.9
Xmlstarlet Command Line Xml Toolkit	Version 0.9.1

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Redhat Fedora Core	Version core_2.0
Trustix Secure Linux	Version 2.0
Trustix Secure Linux	Version 2.1
Ubuntu Ubuntu Linux	Version 4.1
Ubuntu Ubuntu Linux	Version 4.1

References (44)

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000890

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2005/Jan/msg00001.html

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=109880813013482&w=2

Source: cve@mitre.org

http://secunia.com/advisories/13000

Source: cve@mitre.org

http://securitytracker.com/id?1011941

Source: cve@mitre.org

http://www.ciac.org/ciac/bulletins/p-029.shtml

Source: cve@mitre.org

http://www.debian.org/security/2004/dsa-582

Source: cve@mitre.org

http://www.gentoo.org/security/en/glsa/glsa-200411-05.xml

Source: cve@mitre.org

http://www.novell.com/linux/security/advisories/2005_01_sr.html

Source: cve@mitre.org

http://www.osvdb.org/11179

Source: cve@mitre.org

http://www.osvdb.org/11180

Source: cve@mitre.org

http://www.osvdb.org/11324

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2004-615.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2004-650.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/11526

Source: cve@mitre.org

ExploitPatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/17870

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/17872

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/17875

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/17876

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10505

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1173

Source: cve@mitre.org

https://www.ubuntu.com/usn/usn-89-1/

Source: cve@mitre.org

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000890

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.apple.com/archives/security-announce/2005/Jan/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=109880813013482&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/13000

Source: af854a3a-2127-422b-91ae-364da2661108

http://securitytracker.com/id?1011941

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ciac.org/ciac/bulletins/p-029.shtml

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2004/dsa-582

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.gentoo.org/security/en/glsa/glsa-200411-05.xml

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.novell.com/linux/security/advisories/2005_01_sr.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/11179

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/11180

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/11324

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2004-615.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2004-650.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/11526

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/17870

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/17872

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/17875

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/17876

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10505

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1173

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.ubuntu.com/usn/usn-89-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.