CVE-2008-3281

Published: Aug 27, 2008Modified: Apr 23, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.

Affected (26)

Products: Xmlsoft: Libxml2 · Apple: Iphone Os, Safari · Fedoraproject: Fedora · +4 more

Show all products

Xmlsoft: Libxml2 · Apple: Iphone Os, Safari · Fedoraproject: Fedora · Canonical: Ubuntu Linux · Debian: Debian Linux · Redhat: Enterprise Linux Desktop, Enterprise Linux Eus, Enterprise Linux Server, Enterprise Linux Workstation · Vmware: Esx

1 product

2 products

1 product

1 product

1 product

4 products

Enterprise Linux Desktop

Enterprise Linux Eus

Enterprise Linux Server

Enterprise Linux Workstation

Vmware

1 product

Esx

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Xmlsoft Libxml2	Up to 2.6.32

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Apple Iphone Os	From 1.0.0 to 3.0
Apple Safari	Before 4.0

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 9

Configuration D

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 7.04
Canonical Ubuntu Linux	Version 7.10
Canonical Ubuntu Linux	Version 8.04

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 4.0

Configuration F

13 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 3.0
Redhat Enterprise Linux Desktop	Version 4.0
Redhat Enterprise Linux Desktop	Version 5.0
Redhat Enterprise Linux Eus	Version 4.7
Redhat Enterprise Linux Eus	Version 5.2
Redhat Enterprise Linux Server	Version 2.0
Redhat Enterprise Linux Server	Version 3.0
Redhat Enterprise Linux Server	Version 4.0
Redhat Enterprise Linux Server	Version 5.0
Redhat Enterprise Linux Workstation	Version 2.0
Redhat Enterprise Linux Workstation	Version 3.0
Redhat Enterprise Linux Workstation	Version 4.0
Redhat Enterprise Linux Workstation	Version 5.0

Configuration G

4 vulnerable

Vulnerable Software	Affected Versions
Vmware Esx	Version 2.5.4
Vmware Esx	Version 2.5.5
Vmware Esx	Version 3.0.2
Vmware Esx	Version 3.0.3

Related CWEs

CWE-776

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

References (84)

http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html

Source: secalert@redhat.com

Mailing List

http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html

Source: secalert@redhat.com

Broken LinkMailing List

http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html

Source: secalert@redhat.com

Mailing List

http://lists.vmware.com/pipermail/security-announce/2008/000039.html

Source: secalert@redhat.com

Broken Link

http://mail.gnome.org/archives/xml/2008-August/msg00034.html

Source: secalert@redhat.com

Mailing ListPatch

http://secunia.com/advisories/31558

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/31566

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/31590

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/31728

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/31748

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/31855

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/31982

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/32488

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/32807

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/32974

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/35379

Source: secalert@redhat.com

Broken Link

http://security.gentoo.org/glsa/glsa-200812-06.xml

Source: secalert@redhat.com

Third Party Advisory

http://support.apple.com/kb/HT3613

Source: secalert@redhat.com

Third Party Advisory

http://support.apple.com/kb/HT3639

Source: secalert@redhat.com

Third Party Advisory

http://svn.gnome.org/viewvc/libxml2?view=revision&revision=3772

Source: secalert@redhat.com

Broken Link

http://wiki.rpath.com/Advisories:rPSA-2008-0325

Source: secalert@redhat.com

Broken Link

http://www.debian.org/security/2008/dsa-1631

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:180

Source: secalert@redhat.com

Broken Link

http://www.mandriva.com/security/advisories?name=MDVSA-2008:192

Source: secalert@redhat.com

Broken Link

http://www.securityfocus.com/archive/1/497962/100/0/threaded

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/30783

Source: secalert@redhat.com

Broken LinkPatchThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1020728

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/usn-640-1

Source: secalert@redhat.com

Third Party Advisory

http://www.vmware.com/security/advisories/VMSA-2008-0017.html

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2008/2419

Source: secalert@redhat.com

Broken Link

http://www.vupen.com/english/advisories/2008/2843

Source: secalert@redhat.com

Broken Link

http://www.vupen.com/english/advisories/2008/2971

Source: secalert@redhat.com

Broken Link

http://www.vupen.com/english/advisories/2009/1522

Source: secalert@redhat.com

Broken Link

http://www.vupen.com/english/advisories/2009/1621

Source: secalert@redhat.com

Broken Link

http://xmlsoft.org/news.html

Source: secalert@redhat.com

Release Notes

https://bugzilla.redhat.com/show_bug.cgi?id=458086

Source: secalert@redhat.com

Issue Tracking

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6496

Source: secalert@redhat.com

Broken Link

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9812

Source: secalert@redhat.com

Broken Link

https://rhn.redhat.com/errata/RHSA-2008-0836.html

Source: secalert@redhat.com

Third Party Advisory

https://usn.ubuntu.com/644-1/

Source: secalert@redhat.com

Broken Link

https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00261.html

Source: secalert@redhat.com

Mailing List

https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00347.html

Source: secalert@redhat.com

Mailing List

http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html