NetSight
IP …
high7.5

CVE-2016-3705

The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which al…

Impact

The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a crafted XML document containing a large number of nested entity references.

Affected products

VendorProductAffected versions
CanonicalUbuntu Linux
Versions 12.04, 14.04, 15.10, 16.04
XmlsoftLibxml2
Version 2.9.3
DebianDebian Linux
Version 8.0
HpIcewall Federation Agent
Version 3.0
HpIcewall File Manager
Version 3.0
OpensuseLeap
Version 42.1

Weakness classification

CWE-20

References