CVE-2004-0989

2005-03-0105:00:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve

2004

0989

buffer overflow

libxml

remote code execution

ftp

proxy url

security advisory

7.5 High

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.134 Low

EPSS

Percentile

95.5%

JSON

Multiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other versions, may allow remote attackers to execute arbitrary code via (1) a long FTP URL that is not properly handled by the xmlNanoFTPScanURL function, (2) a long proxy URL containing FTP data that is not properly handled by the xmlNanoFTPScanProxy function, and other overflows related to manipulation of DNS length values, including (3) xmlNanoFTPConnect, (4) xmlNanoHTTPConnectHost, and (5) xmlNanoHTTPConnectHost.

CPENameOperatorVersion
xmlsoft:libxml2xmlsoft libxml2eq2.6.11
xmlsoft:libxml2xmlsoft libxml2eq2.6.13
xmlsoft:libxml2xmlsoft libxml2eq2.6.7
xmlsoft:libxml2xmlsoft libxml2eq2.6.14
xmlstarlet:command_line_xml_toolkitxmlstarlet command line xml toolkiteq0.9.1
xmlsoft:libxml2xmlsoft libxml2eq2.6.8
xmlsoft:libxml2xmlsoft libxml2eq2.5.11
xmlsoft:libxmlxmlsoft libxmleq1.8.17
xmlsoft:libxml2xmlsoft libxml2eq2.6.12
xmlsoft:libxml2xmlsoft libxml2eq2.6.9

CPE	Name	Operator	Version
xmlsoft:libxml2	xmlsoft libxml2	eq	2.6.11
xmlsoft:libxml2	xmlsoft libxml2	eq	2.6.13
xmlsoft:libxml2	xmlsoft libxml2	eq	2.6.7
xmlsoft:libxml2	xmlsoft libxml2	eq	2.6.14
xmlstarlet:command_line_xml_toolkit	xmlstarlet command line xml toolkit	eq	0.9.1
xmlsoft:libxml2	xmlsoft libxml2	eq	2.6.8
xmlsoft:libxml2	xmlsoft libxml2	eq	2.5.11
xmlsoft:libxml	xmlsoft libxml	eq	1.8.17
xmlsoft:libxml2	xmlsoft libxml2	eq	2.6.12
xmlsoft:libxml2	xmlsoft libxml2	eq	2.6.9