Lucene search

K
osvGoogleOSV:DLA-355-1
HistoryNov 29, 2015 - 12:00 a.m.

libxml2 - security update

2015-11-2900:00:00
Google
osv.dev
18

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.011 Low

EPSS

Percentile

84.7%

  • CVE-2015-8241
    Buffer overread with XML parser in xmlNextChar
  • CVE-2015-8317
    • issues in the xmlParseXMLDecl function:
      If we fail conversing the current input stream while
      processing the encoding declaration of the XMLDecl
      then it’s safer to just abort there and not try to
      report further errors.
    • If the string is not properly terminated do not try to convert
      to the given encoding.

Additional fix for off by one error in previous patch for CVE-2015-7942
(thanks to Salvatore for spotting this)

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.011 Low

EPSS

Percentile

84.7%