National Cyber-Alert System

Vulnerability Summary for CVE-2008-4409

Overview

libxml2 2.7.0 and 2.7.1 does not properly handle "predefined entities definitions" in entities, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash), as demonstrated by use of xmllint on a certain XML document, a different vulnerability than CVE-2003-1564 and CVE-2008-3281.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Solution

Patch Information - http://www.securityfocus.com/bid/30783/solution}

Vendor Statements (disclaimer)

Official Statement from Red Hat (01/01/1900)

Not vulnerable. This issue did not affect the versions of libxml2 as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: FEDORA

Name: FEDORA-2008-8582

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00130.html

External Source: FEDORA

Name: FEDORA-2008-8575

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00125.html

External Source: XF

Name: libxml2-xml-file-dos(45633)

Hyperlink:http://xforce.iss.net/xforce/xfdb/45633

External Source: VUPEN

Name: ADV-2009-1621

Hyperlink:http://www.vupen.com/english/advisories/2009/1621

External Source: VUPEN

Name: ADV-2009-1522

Hyperlink:http://www.vupen.com/english/advisories/2009/1522

External Source: BID

Name: 31555

Hyperlink:http://www.securityfocus.com/bid/31555

External Source: MANDRIVA

Name: MDVSA-2008:212

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:212

External Source: CONFIRM

Name: http://support.apple.com/kb/HT3639

Hyperlink:http://support.apple.com/kb/HT3639

External Source: CONFIRM

Name: http://support.apple.com/kb/HT3613

Hyperlink:http://support.apple.com/kb/HT3613

External Source: GENTOO

Name: GLSA-200812-06

Hyperlink:http://security.gentoo.org/glsa/glsa-200812-06.xml

External Source: SECUNIA

Name: 35379

Hyperlink:http://secunia.com/advisories/35379

External Source: SECUNIA

Name: 32974

Hyperlink:http://secunia.com/advisories/32974

External Source: SECUNIA

Name: 32175

Hyperlink:http://secunia.com/advisories/32175

External Source: SECUNIA

Name: 32130

Hyperlink:http://secunia.com/advisories/32130

External Source: MLIST

Name: [oss-security] 20081002 libxml2 "ampproblem" DoS

Hyperlink:http://openwall.com/lists/oss-security/2008/10/02/4

External Source: APPLE

Name: APPLE-SA-2009-06-17-1

Hyperlink:http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html

External Source: APPLE

Name: APPLE-SA-2009-06-08-1

Hyperlink:http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html

External Source: CONFIRM

Name: http://bugzilla.gnome.org/show_bug.cgi?id=554660

Hyperlink:http://bugzilla.gnome.org/show_bug.cgi?id=554660