CVE-2015-7941

Published: Nov 18, 2015Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities.

Affected (4)

Products: Canonical: Ubuntu Linux · Xmlsoft: Libxml2

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.04

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Xmlsoft Libxml2	Version 2.9.2

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (44)

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177341.html

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177381.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=145382616617563&w=2

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2015-2549.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2015-2550.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2016-1089.html

Source: cve@mitre.org

http://www.debian.org/security/2015/dsa-3430

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2015/10/22/5

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2015/10/22/8

Source: cve@mitre.org

http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

Source: cve@mitre.org

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/74241

Source: cve@mitre.org

http://www.securitytracker.com/id/1034243

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-2812-1

Source: cve@mitre.org

http://xmlsoft.org/news.html

Source: cve@mitre.org

https://bugzilla.gnome.org/show_bug.cgi?id=744980

Source: cve@mitre.org

https://git.gnome.org/browse/libxml2/commit/?id=9b8512337d14c8ddf662fcb98b0135f225a1c489

Source: cve@mitre.org

https://git.gnome.org/browse/libxml2/commit/?id=a7dfab7411cbf545f359dd3157e5df1eb0e7ce31

Source: cve@mitre.org

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944172

Source: cve@mitre.org

https://security.gentoo.org/glsa/201701-37

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177341.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177381.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=145382616617563&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2015-2549.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2015-2550.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2016-1089.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2015/dsa-3430

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2015/10/22/5

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2015/10/22/8

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/74241

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id/1034243

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-2812-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://xmlsoft.org/news.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.gnome.org/show_bug.cgi?id=744980

Source: af854a3a-2127-422b-91ae-364da2661108

https://git.gnome.org/browse/libxml2/commit/?id=9b8512337d14c8ddf662fcb98b0135f225a1c489

Source: af854a3a-2127-422b-91ae-364da2661108

https://git.gnome.org/browse/libxml2/commit/?id=a7dfab7411cbf545f359dd3157e5df1eb0e7ce31

Source: af854a3a-2127-422b-91ae-364da2661108

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944172

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/201701-37

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.