NetSight
IP …
medium5.0

CVE-2015-7499

Heap-based buffer overflow in nokogiri

Impact

Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially sensitive information, or crash the application.

Affected packages

EcosystemPackageAffectedFixed in
rubygemsnokogiri>= 1.6.0, <= 1.6.7.11.6.7.2

Affected products

VendorProductAffected versions
AppleIphone Os
through 9.2.1
AppleMac Os X
through 10.11.3
AppleTvos
through 9.1
AppleWatchos
through 2.1
CanonicalUbuntu Linux
Versions 12.04, 14.04, 15.04, 15.10
RedhatEnterprise Linux Desktop
Version 6.0
RedhatEnterprise Linux Hpc Node
Version 6.0
RedhatEnterprise Linux Server
Version 6.0
RedhatEnterprise Linux Workstation
Version 6.0
HpIcewall Federation Agent
Version 3.0
HpIcewall File Manager
Version 3.0
XmlsoftLibxml2
through 2.9.2

Weakness classification

CWE-119

References