Vulnerability identifier: #VU32853
Vulnerability risk: High
CVSSv3.1: 8.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-122
Exploitation vector: Network
Exploit availability: Yes
Vulnerable software:
Libxml2
Universal components / Libraries /
Libraries used by multiple products
Vendor: Gnome Development Team
Description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier,. A remote attacker can use a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node to trigger heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Mitigation
Update to version 2.7.0.
Vulnerable software versions
Libxml2: 2.6.0 - 2.6.32
External links
http://git.gnome.org/browse/libxml2/commit/?id=d7958b21e7f8c447a26bb2436f08402b2c308be4
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
http://lists.apple.com/archives/security-announce/2012/May/msg00001.html
http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062238.html
http://lists.opensuse.org/opensuse-updates/2011-07/msg00035.html
http://rhn.redhat.com/errata/RHSA-2013-0217.html
http://scarybeastsecurity.blogspot.com/2011/05/libxml-vulnerability-and-interesting.html
http://secunia.com/advisories/44711
http://support.apple.com/kb/HT5281
http://support.apple.com/kb/HT5503
http://ubuntu.com/usn/usn-1153-1
http://www.debian.org/security/2011/dsa-2255
http://www.mandriva.com/security/advisories?name=MDVSA-2011:131
http://www.openwall.com/lists/oss-security/2011/05/31/8
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/73248
http://www.redhat.com/support/errata/RHSA-2011-1749.html
http://www.securityfocus.com/bid/48056
http://bugzilla.redhat.com/show_bug.cgi?id=709747
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.