CVE-2015-7941
Published: 23 October 2015
libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
libxml2 Launchpad, Ubuntu, Debian |
precise |
Released
(2.7.8.dfsg-5.1ubuntu4.12)
|
| trusty |
Released
(2.9.1+dfsg1-3ubuntu4.5)
|
|
| upstream |
Released
(2.9.2+really2.9.1+dfsg1-0.1)
|
|
| vivid |
Released
(2.9.2+dfsg1-3ubuntu0.1)
|
|
| wily |
Not vulnerable
(2.9.2+zdfsg1-4)
|
|
|
Patches: upstream: https://git.gnome.org/browse/libxml2/commit/?id=a7dfab7411cbf545f359dd3157e5df1eb0e7ce31 upstream: https://git.gnome.org/browse/libxml2/commit/?id=9b8512337d14c8ddf662fcb98b0135f225a1c489 |
||