CVE-2008-3529
high · 10Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a long XML entity name.
10
CVSS
23.4%
EPSS (exploit prob.)
98th
EPSS percentile
2008-09-12
Published
AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-119
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| xmlsoft | libxml2 | < 2.7.0 |
| debian | debian_linux | 4.0 |
| canonical | ubuntu_linux | 6.06 |
| canonical | ubuntu_linux | 6.06 |
| canonical | ubuntu_linux | 7.04 |
| canonical | ubuntu_linux | 7.10 |
| canonical | ubuntu_linux | 8.04 |
| canonical | ubuntu_linux | 8.04 |
| canonical | ubuntu_linux | 8.10 |
| canonical | ubuntu_linux | 9.04 |
| apple | safari | < 4.0 |
| apple | safari | >= 3.2.0, < 3.2.3 |
| apple | iphone_os | < 3.0 |
| apple | mac_os_x | < 10.5.7 |
| apple | mac_os_x | 10.5.7 |
Check a specific version with /api/v1/cve/match.
References
- http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
- http://lists.apple.com/archives/security-announce/2009/May/msg00000.html
- http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html
- http://secunia.com/advisories/31558
- http://secunia.com/advisories/31855
- http://secunia.com/advisories/31860
- http://secunia.com/advisories/31868
- http://secunia.com/advisories/31982
- http://secunia.com/advisories/32265
- http://secunia.com/advisories/32280
- http://secunia.com/advisories/32807
- http://secunia.com/advisories/32974
- http://secunia.com/advisories/33715
- http://secunia.com/advisories/33722
- http://secunia.com/advisories/35056
- http://secunia.com/advisories/35074
- http://secunia.com/advisories/35379
- http://secunia.com/advisories/36173
- http://secunia.com/advisories/36235
- http://security.gentoo.org/glsa/glsa-200812-06.xml
- http://securitytracker.com/id?1020855
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-126356-03-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-141243-01-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-247346-1
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2008-3529