NetSight
IP …
high7.1

CVE-2015-5312

The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attacker…

Impact

The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660.

Affected products

VendorProductAffected versions
CanonicalUbuntu Linux
Versions 12.04, 14.04, 15.04, 15.10
RedhatEnterprise Linux Desktop
Version 6.0
RedhatEnterprise Linux Hpc Node
Version 6.0
RedhatEnterprise Linux Server
Version 6.0
RedhatEnterprise Linux Workstation
Version 6.0
AppleIphone Os
through 9.2.1
AppleMac Os X
through 10.11.3
AppleTvos
through 9.1
AppleWatchos
through 2.1
XmlsoftLibxml2
through 2.9.2
HpIcewall Federation Agent
Version 3.0
HpIcewall File Manager
Version 3.0

Weakness classification

CWE-399

References