CVE-2015-8710

Published: Apr 11, 2016Modified: May 6, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of-bounds heap memory access and application crash), or possibly have unspecified other impact via an unclosed HTML comment.

Affected (4)

Products: Xmlsoft: Libxml2 · Debian: Debian Linux

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Xmlsoft Libxml2	Before 2.9.3

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (18)

http://rhn.redhat.com/errata/RHSA-2016-1089.html

Source: security@debian.org

Third Party Advisory

http://www.debian.org/security/2015/dsa-3430

Source: security@debian.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2015/04/19/4

Source: security@debian.org

Mailing ListPatch

http://www.openwall.com/lists/oss-security/2015/09/13/1

Source: security@debian.org

Mailing List

http://www.openwall.com/lists/oss-security/2015/12/31/7

Source: security@debian.org

Mailing List

http://www.securityfocus.com/bid/79811

Source: security@debian.org

Third Party AdvisoryVDB Entry

https://bugzilla.gnome.org/show_bug.cgi?id=746048

Source: security@debian.org

Issue Tracking

https://git.gnome.org/browse/libxml2/commit/?id=e724879d964d774df9b7969fc846605aa1bac54c

Source: security@debian.org

Third Party Advisory

https://hackerone.com/reports/57125#activity-384861

Source: security@debian.org

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-1089.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.debian.org/security/2015/dsa-3430

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.openwall.com/lists/oss-security/2015/04/19/4

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatch

http://www.openwall.com/lists/oss-security/2015/09/13/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

http://www.openwall.com/lists/oss-security/2015/12/31/7

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

http://www.securityfocus.com/bid/79811

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://bugzilla.gnome.org/show_bug.cgi?id=746048

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

https://git.gnome.org/browse/libxml2/commit/?id=e724879d964d774df9b7969fc846605aa1bac54c

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://hackerone.com/reports/57125#activity-384861

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.