NetSight
IP …
medium6.5

CVE-2008-3281

libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause …

Impact

libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.

Affected products

VendorProductAffected versions
XmlsoftLibxml2
through 2.6.32
AppleSafari
before 4.0
AppleIphone Os
from 1.0.0 before 3.0
FedoraprojectFedora
Version 9
CanonicalUbuntu Linux
Versions 6.06, 7.04, 7.10, 8.04
DebianDebian Linux
Version 4.0
RedhatEnterprise Linux Desktop
Versions 3.0, 4.0, 5.0
RedhatEnterprise Linux Eus
Versions 4.7, 5.2
RedhatEnterprise Linux Server
Versions 2.0, 3.0, 4.0, 5.0
RedhatEnterprise Linux Workstation
Versions 2.0, 3.0, 4.0, 5.0
VmwareEsx
Versions 2.5.4, 2.5.5, 3.0.2, 3.0.3

Weakness classification

CWE-776

References