Libxml2 Heap Overflow in xmlParseAttValueComplex() Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1020855 |
|
SecurityTracker URL: http://securitytracker.com/id/1020855
|
|
CVE Reference:
CVE-2008-3529
(Links to External Site)
|
Date: Sep 11 2008
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): prior to 2.7.0
|
Description:
A vulnerability was reported in Libxml2. A remote user can cause arbitrary code to be executed on the target system.
A remote user can create a specially crafted XML entity name that, when processed by the target application using libxml2, will trigger a heap overflow and execute arbitrary code on the target system. The code will run with the privileges of the target application.
The vulnerability resides in the xmlParseAttValueComplex() function in 'parser.c'.
|
Impact:
A remote user can execute arbitrary code on the target system.
|
Solution:
The vendor has issued a fixed version (2.7.0).
|
Vendor URL: xmlsoft.org/ (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Thu, 11 Sep 2008 16:41:22 -0400
Subject: libxml2
|
Red Hat said:
It was discovered, that libxml2 does not properly handle long XML entity names.
In the xmlParseAttValueComplex() function in parser.c, when entity name is not
substituted with entity value, but is sent to output unchanged, buffer used to
store entity name may not be grown sufficiently in case of long entity names,
resulting in a heap buffer overflow.
Issue is already fixed upstream in version 2.7.0.
CVE-2008-3529
|
|
