NetSight
IP …
critical9.3Public exploit code

CVE-2011-1944

Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

Affected products

VendorProductAffected versions
XmlsoftLibxml2
Versions 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5
XmlsoftLibxml
through 1.8.16
Versions 1.5.0, 1.6.0, 1.6.1, 1.6.2, 1.7.0

Weakness classification

CWE-189

References