CVE-2010-4008

Published: Nov 17, 2010Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service (application crash) via a crafted XML document.

Affected (25)

Products: Google: Chrome · Apple: Iphone Os, Itunes, Mac Os X, Safari · Xmlsoft: Libxml2 · +6 more

Show all products

1 product

4 products

1 product

1 product

1 product

4 products

Enterprise Linux Desktop

Enterprise Linux Server

Enterprise Linux Server Eus

Enterprise Linux Workstation

Opensuse

1 product

Opensuse

Suse

1 product

Suse Linux Enterprise Server

Apache

1 product

Openoffice

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Google Chrome	Before 7.0.517.44

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Apple Iphone Os	Before 4.2
Apple Itunes	Before 10.2
Apple Mac Os X	Before 10.6.7
Apple Safari	Before 5.0.4

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Xmlsoft Libxml2	Before 2.7.8

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 5.0
Debian Debian Linux	Version 6.0

Configuration E

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 10.10
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 9.10

Configuration F

4 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server Eus	Version 6.3
Redhat Enterprise Linux Workstation	Version 6.0

Configuration G

6 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 11.1
Opensuse Opensuse	Version 11.2
Opensuse Opensuse	Version 11.3
Suse Suse Linux Enterprise Server	Version 10 sp3
Suse Suse Linux Enterprise Server	Version 11
Suse Suse Linux Enterprise Server	Version 11 sp1

Configuration H

2 vulnerable

Vulnerable Software	Affected Versions
Apache Openoffice	From 2.0.0 to 2.4.3
Apache Openoffice	From 3.0.0 to 3.3.0

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (64)

http://blog.bkis.com/en/libxml2-vulnerability-in-google-chrome-and-apple-safari/

Source: product-security@apple.com

Broken Link

http://code.google.com/p/chromium/issues/detail?id=58731

Source: product-security@apple.com

ExploitIssue TrackingPatchVendor Advisory

http://googlechromereleases.blogspot.com/2010/11/stable-channel-update.html

Source: product-security@apple.com

Vendor Advisory

http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html

Source: product-security@apple.com

Mailing ListThird Party Advisory

http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html

Source: product-security@apple.com

Mailing ListThird Party Advisory

http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.html

Source: product-security@apple.com

Mailing ListThird Party Advisory

http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html

Source: product-security@apple.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html

Source: product-security@apple.com

Mailing ListThird Party Advisory

http://mail.gnome.org/archives/xml/2010-November/msg00015.html

Source: product-security@apple.com

Mailing ListRelease NotesVendor Advisory

http://marc.info/?l=bugtraq&m=130331363227777&w=2

Source: product-security@apple.com

Third Party Advisory

http://marc.info/?l=bugtraq&m=139447903326211&w=2

Source: product-security@apple.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-0217.html

Source: product-security@apple.com

Third Party Advisory

http://secunia.com/advisories/40775

Source: product-security@apple.com

Third Party Advisory

http://secunia.com/advisories/42109

Source: product-security@apple.com

Third Party AdvisoryVendor Advisory

http://secunia.com/advisories/42175

Source: product-security@apple.com

Third Party AdvisoryVendor Advisory

http://secunia.com/advisories/42314

Source: product-security@apple.com

Third Party Advisory

http://secunia.com/advisories/42429

Source: product-security@apple.com

Third Party Advisory

http://support.apple.com/kb/HT4456

Source: product-security@apple.com

Third Party Advisory

http://support.apple.com/kb/HT4554

Source: product-security@apple.com

Third Party Advisory

http://support.apple.com/kb/HT4566

Source: product-security@apple.com

Third Party Advisory

http://support.apple.com/kb/HT4581

Source: product-security@apple.com

Third Party Advisory

http://www.debian.org/security/2010/dsa-2128

Source: product-security@apple.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2010:243

Source: product-security@apple.com

Third Party Advisory

http://www.openoffice.org/security/cves/CVE-2010-4008_CVE-2010-4494.html

Source: product-security@apple.com

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2011-1749.html

Source: product-security@apple.com

Third Party Advisory

http://www.securityfocus.com/bid/44779

Source: product-security@apple.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-1016-1

Source: product-security@apple.com

Third Party Advisory

http://www.vupen.com/english/advisories/2010/3046

Source: product-security@apple.com

Permissions Required

http://www.vupen.com/english/advisories/2010/3076

Source: product-security@apple.com

Permissions Required

http://www.vupen.com/english/advisories/2010/3100

Source: product-security@apple.com

Permissions Required

http://www.vupen.com/english/advisories/2011/0230

Source: product-security@apple.com

Permissions Required

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12148

Source: product-security@apple.com

Third Party Advisory

http://blog.bkis.com/en/libxml2-vulnerability-in-google-chrome-and-apple-safari/