CVE-2015-8806

Published: Apr 13, 2016Modified: May 6, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the "<!DOCTYPE html" substring in a crafted HTML document.

Affected (6)

Products: Xmlsoft: Libxml2 · Canonical: Ubuntu Linux · Debian: Debian Linux

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Xmlsoft Libxml2	Before 2.9.4

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.10
Canonical Ubuntu Linux	Version 16.04

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

References (14)

http://www.openwall.com/lists/oss-security/2016/02/03/5

Source: security@debian.org

Mailing ListThird Party Advisory

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

Source: security@debian.org

Third Party Advisory

http://www.securityfocus.com/bid/82071

Source: security@debian.org

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2994-1

Source: security@debian.org

Third Party Advisory

https://bugzilla.gnome.org/show_bug.cgi?id=749115

Source: security@debian.org

Issue TrackingVendor Advisory

https://security.gentoo.org/glsa/201701-37

Source: security@debian.org

Third Party Advisory

https://www.debian.org/security/2016/dsa-3593

Source: security@debian.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2016/02/03/5