CVE-2008-3529
NoneCVSS
—
EPSS
23.4%
Published
Sep 12, 2008
CISA due date
—
The record
Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a long XML entity name.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | libxml2 | 0 | 2.6.32.dfsg-4 |
| Debian:12 | libxml2 | 0 | 2.6.32.dfsg-4 |
| Debian:13 | libxml2 | 0 | 2.6.32.dfsg-4 |
| Debian:14 | libxml2 | 0 | 2.6.32.dfsg-4 |
| Debian:4.0 | libxml2 | 0 | 2.6.27.dfsg-5 |
| Red Hat:enterprise_linux:2.1::as | libxml2 | 0 | 0:2.4.19-11.ent |
| Red Hat:enterprise_linux:2.1::as | libxml2-devel | 0 | 0:2.4.19-11.ent |
| Red Hat:enterprise_linux:2.1::as | libxml2-python | 0 | 0:2.4.19-11.ent |
| Red Hat:enterprise_linux:2.1::aw | libxml2 | 0 | 0:2.4.19-11.ent |
| Red Hat:enterprise_linux:2.1::aw | libxml2-devel | 0 | 0:2.4.19-11.ent |
| Red Hat:enterprise_linux:2.1::aw | libxml2-python | 0 | 0:2.4.19-11.ent |
| Red Hat:enterprise_linux:2.1::es | libxml2 | 0 | 0:2.4.19-11.ent |
| Red Hat:enterprise_linux:2.1::es | libxml2-devel | 0 | 0:2.4.19-11.ent |
| Red Hat:enterprise_linux:2.1::es | libxml2-python | 0 | 0:2.4.19-11.ent |
| Red Hat:enterprise_linux:2.1::ws | libxml2 | 0 | 0:2.4.19-11.ent |
| Red Hat:enterprise_linux:2.1::ws | libxml2-devel | 0 | 0:2.4.19-11.ent |
| Red Hat:enterprise_linux:2.1::ws | libxml2-python | 0 | 0:2.4.19-11.ent |
| Red Hat:enterprise_linux:3::as | libxml2 | 0 | 0:2.5.10-13 |
| Red Hat:enterprise_linux:3::as | libxml2-debuginfo | 0 | 0:2.5.10-13 |
| Red Hat:enterprise_linux:3::as | libxml2-devel | 0 | 0:2.5.10-13 |
| Red Hat:enterprise_linux:3::as | libxml2-python | 0 | 0:2.5.10-13 |
| Red Hat:enterprise_linux:3::desktop | libxml2 | 0 | 0:2.5.10-13 |
| Red Hat:enterprise_linux:3::desktop | libxml2-debuginfo | 0 | 0:2.5.10-13 |
| Red Hat:enterprise_linux:3::desktop | libxml2-devel | 0 | 0:2.5.10-13 |
| Red Hat:enterprise_linux:3::desktop | libxml2-python | 0 | 0:2.5.10-13 |
| Red Hat:enterprise_linux:3::es | libxml2 | 0 | 0:2.5.10-13 |
| Red Hat:enterprise_linux:3::es | libxml2-debuginfo | 0 | 0:2.5.10-13 |
| Red Hat:enterprise_linux:3::es | libxml2-devel | 0 | 0:2.5.10-13 |
| Red Hat:enterprise_linux:3::es | libxml2-python | 0 | 0:2.5.10-13 |
| Red Hat:enterprise_linux:3::ws | libxml2 | 0 | 0:2.5.10-13 |
| Red Hat:enterprise_linux:3::ws | libxml2-debuginfo | 0 | 0:2.5.10-13 |
| Red Hat:enterprise_linux:3::ws | libxml2-devel | 0 | 0:2.5.10-13 |
| Red Hat:enterprise_linux:3::ws | libxml2-python | 0 | 0:2.5.10-13 |
| Red Hat:enterprise_linux:4::as | libxml2 | 0 | 0:2.6.16-12.5 |
| Red Hat:enterprise_linux:4::as | libxml2-debuginfo | 0 | 0:2.6.16-12.5 |
| Red Hat:enterprise_linux:4::as | libxml2-devel | 0 | 0:2.6.16-12.5 |
| Red Hat:enterprise_linux:4::as | libxml2-python | 0 | 0:2.6.16-12.5 |
| Red Hat:enterprise_linux:4::desktop | libxml2 | 0 | 0:2.6.16-12.5 |
| Red Hat:enterprise_linux:4::desktop | libxml2-debuginfo | 0 | 0:2.6.16-12.5 |
| Red Hat:enterprise_linux:4::desktop | libxml2-devel | 0 | 0:2.6.16-12.5 |
| Red Hat:enterprise_linux:4::desktop | libxml2-python | 0 | 0:2.6.16-12.5 |
| Red Hat:enterprise_linux:4::es | libxml2 | 0 | 0:2.6.16-12.5 |
| Red Hat:enterprise_linux:4::es | libxml2-debuginfo | 0 | 0:2.6.16-12.5 |
| Red Hat:enterprise_linux:4::es | libxml2-devel | 0 | 0:2.6.16-12.5 |
| Red Hat:enterprise_linux:4::es | libxml2-python | 0 | 0:2.6.16-12.5 |
| Red Hat:enterprise_linux:4::ws | libxml2 | 0 | 0:2.6.16-12.5 |
| Red Hat:enterprise_linux:4::ws | libxml2-debuginfo | 0 | 0:2.6.16-12.5 |
| Red Hat:enterprise_linux:4::ws | libxml2-devel | 0 | 0:2.6.16-12.5 |
| Red Hat:enterprise_linux:4::ws | libxml2-python | 0 | 0:2.6.16-12.5 |
| Red Hat:enterprise_linux:5::client | libxml2 | 0 | 0:2.6.26-2.1.2.6 |
| Red Hat:enterprise_linux:5::client | libxml2-debuginfo | 0 | 0:2.6.26-2.1.2.6 |
| Red Hat:enterprise_linux:5::client | libxml2-devel | 0 | 0:2.6.26-2.1.2.6 |
| Red Hat:enterprise_linux:5::client | libxml2-python | 0 | 0:2.6.26-2.1.2.6 |
| Red Hat:enterprise_linux:5::client_workstation | libxml2 | 0 | 0:2.6.26-2.1.2.6 |
| Red Hat:enterprise_linux:5::client_workstation | libxml2-debuginfo | 0 | 0:2.6.26-2.1.2.6 |
| Red Hat:enterprise_linux:5::client_workstation | libxml2-devel | 0 | 0:2.6.26-2.1.2.6 |
| Red Hat:enterprise_linux:5::client_workstation | libxml2-python | 0 | 0:2.6.26-2.1.2.6 |
| Red Hat:enterprise_linux:5::server | libxml2 | 0 | 0:2.6.26-2.1.2.6 |
| Red Hat:enterprise_linux:5::server | libxml2-debuginfo | 0 | 0:2.6.26-2.1.2.6 |
| Red Hat:enterprise_linux:5::server | libxml2-devel | 0 | 0:2.6.26-2.1.2.6 |
| Red Hat:enterprise_linux:5::server | libxml2-python | 0 | 0:2.6.26-2.1.2.6 |
Related vulnerabilities
- CVE-2017-16932 parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter… Also affects libxml2
- CVE-2017-0663 A remote code execution vulnerability in libxml2 could enable an attacker using a… Also affects libxml2
- CVE-2017-8872 The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to… Also affects libxml2
- CVE-2016-9318 libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does… Also affects libxml2
- CVE-2016-4448 Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified… Also affects libxml2
- CVE-2016-4447 The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows… Also affects libxml2
- CVE-2015-8806 dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer… Also affects libxml2
- CVE-2015-7499 Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3… Also affects libxml2